I've managed to register new Trusted Identity Provider on my farm, and I'm using Azure ACS as the provider.
I have no issues adding yahoo and gmail users by their email addresses, but if I add a WLID user, I get the message that the site has not been shared with me (when I try to sign in). I went through the Sharepoint logs and saw that WLID returns IsAuthenticated=true, so I assume the issue is with the site privileges themselves.
When I copy the user id hash that WLID returns, and add that as an user to Sharepoint site (instead of email address), then I'm able to sign in. This is extremely inconvenient. I must be able to add users by their email addresses, on SP site.
I know WLID uses only nameidentifier as an input claim, but I created the rule on the ACS that's supposed to map incoming nameidentifier into the emailaddress claim. I assume I did something wrong, but not sure what.