We have an Azure App Service which uses internal database user authentication and I'm in the process of switching it to Azure AD SAML 2.0 authentication.
I'm pretty sure I have it connected correctly, but I might be missing something in the User field mapping...
When I go to the login page, it redirects me to our AzureAD tenancy sign-in where I input my creds, get the MFA SMS and then it attempts to return to the app and I am presented with:
Azure AD single sign on failed.
The App has a form of logging in the SQL DB and when I look at the last entry, the details are:
Loading SAML Response LOGIN STATUS Login Status urn:oasis:names:tc:SAML:2.0:status:Success ASSERTION NODE CONDITIONS TIME RANGE CHECK NotBefore: 2019-05-28T05:46:49.6740000Z Now: 2019-05-28T05:51:49.8790022Z NotOnOrAfter: 2019-05-28T06:46:49.6740000Z Time Range OK ISSUER Issuer OK SIGNATURE VALIDATION Checking response node for signature. + (samlp:Response/ds:Signature) Response signature not found Checking Assertion node for signature. (ds:Signature) Signature found CERTIFICATE LOAD Certificate loaded "CN=accounts.accesscontrol.windows.net" SIGNATURE CHECK Signature check OK USER SYNC Attribute Names: http://schemas.microsoft.com/identity/claims/tenantid, http://schemas.microsoft.com/identity/claims/objectidentifier, http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name, http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname, http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname, http://schemas.microsoft.com/identity/claims/displayname, http://schemas.microsoft.com/ws/2008/06/identity/claims/groups, http://schemas.microsoft.com/identity/claims/identityprovider, http://schemas.microsoft.com/claims/authnmethodsreferences USERNAME Get username from mapping Field Mapping - USERNAME to http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress (saml:AttributeStatement/saml:Attribute[@Name='http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress']). http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress not found EXCEPTION Username not found at AzureADSamlExtension.AzureAdSamlIdentity.<SamlAuthenticate>d__13.MoveNext()
If I remove the "schema" url's within the App's SAML profile field mapping settings so they are all empty and then retry, the different response I get is:
USER SYNC USERNAME Get SAML default Username (saml:Subject/saml:NameID) EXCEPTION No User Match at AzureADSamlExtension.AzureAdSamlIdentity.<SamlAuthenticate>d__13.MoveNext()
I'm waiting on the App developers to get back to me with support, but whilst trying to troubleshoot it myself, I'd like to know what I might be able to try to get it working.
The main field to start with is obviously going to be the User Name which is just our user's O365 email address... For what it's worth, I've already tried "mail", "userPrincipalName" and "User name"; they all result in a similar
Field Mapping - USERNAME to *xyz* error.