Issue
When SSO is enabled, some SAML request will fail with SAML2Error: SAML failed to login, Status code is urn:oasis:names:tc:SAML:2.0:status:Requester
When checking the SAML response coming from the IDP you may notice this :urn:oasis:names:tc:SAML:2.0:status:InvalidNameIDPolicy" /></samlp:StatusCode></samlp:Status></samlp:Response>
Release
All versions
Resolution
The explanation and resolution in KB0657094 holds true.
Additional to this, from a ServiceNow perspective, you can tackle this by changing the NameID policy in your IDP record.
Most of the times it would be
urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress.
Replacing it with
urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified
should give relief.
Also, unchecking "Create an AuthnContextClass" in the same IDP configuration does help.
You would still need to consult with your IDP admin and decide if the methods above are the ones that satisfy your business requirements.
A refresh of Claim Rules would be then desirable.
