ADFS 2.0 simpleSAML issue: More than one claim based on SamlNameIdentifierClaimResource was produced

Question

I am trying to setup an ADFS 2.0 IDP - simplesaml saml sp configuration, and i am blocked, the errors reported by ADFS are nowere to be found even in the official adfs documentation. I have sucessfully set up the relaying party, from the sp app i get redirected to the idp, i can authentify, but upon redirection to the sp i get this:

The Federation Service could not fulfill the token-issuance request.
More than  one claim based on SamlNameIdentifierClaimResource was produced after the
issuance  transform rules were applies for relying party 'url here'. Please see event  
500 with the same instance id for claims after application of issuance transform rules. 

Additional Data 
Instance id: 44ef5c64-7bcb-4766-9016-75034b4fd7eb 

User Action 
Ensure that the issuance transform rules that are configured for the relying party do not result in multiple claims based on SamlNameIdentifierClaimResource.

Also, a warning:

More information for the event entry with instance id 44ef5c64-7bcb4766-9016-75034b4fd7eb. 
There may be more events with the same instance id with more information. 

Instance id:  
44ef5c64-7bcb-4766-9016-75034b4fd7eb 


Issued identity: 
http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname 
user name i used
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier 
user name i used
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier 
CKTECHNO\user name i used
http://schemas.microsoft.com/ws/2008/06/identity/claims/authenticationmethod 
http://schemas.microsoft.com/ws/2008/06/identity/authenticationmethod/windows 
http://schemas.microsoft.com/ws/2008/06/identity/claims/authenticationinstant 
2013-07-08T14:30:46.465Z 

Here is my conf:

I searched everywere, there is no mention of this type of error. Even the 500 event i don't seem to find in the ms docs. Any help is greatly appreciated. Thanks!

Answer 1

Thanks @nzpcmad, the problem was indeed the fact that the account name is added by default, as are also the groups, and i was creating it twice. It's really a shame that this is not clearly specified, as you can't really tell that this is the case. Problem solved.

Answer 2

First of all, +1 for well-documented question.

I suspect the problem is because the windows account name is one of the in-built claims. What happens if you remove the mapping for sAMAccountName? (i.e. just have the transform).

Also, it is more usual to use the email name. That's the one I always use.