Login failed due to missing SAML EPPN attribute

Overview

This article providers details about how to troubleshoot and resolve Single Sign On (SSO) login errors related to the Login failed due to missing SAML EPPN attribute error page.

Causes

This issue can happen for several reasons. The most common are fall under a couple of different categories.

No SAML EPPN Attribute Detected

We could not detect an eppn attribute in your session. Some common reasons that this might occur are:

• Your organization is not releasing an eppn SAML attribute in outbound assertions.
• Your account does not have a value for the identity system attribute which backs the eppn SAML attribute in outbound assertions.
• Your organization is releasing SAML attributes to our service that are not formatted correctly, or cannot otherwise be parsed, such that they are ignored.
• Your organization is not releasing any SAML attributes to our service in outbound assertions.

Unscoped SAML EPPN Attribute

Your organization is releasing unscoped, or not fully qualified with a domain, eppn attribute values. This means that values are coming through as john.doe (incorrect) instead of john.doe@example.com (correct). Our service requires scoped (fully qualified) eppn values. 

SAML EPPN Attribute With Rejected Scope

The eppn attribute value for your account has a scope (domain) that has not been allowed by this service. This causes the login to be rejected. For example, your username is being released as john.doe@mail.example.com, but your organization has instructed our service to only allow usernames with @example.com domains.

This can also occur if the scope (domain) of your eppn value is not consistently cased. For instance, an eppn value of john.doe@Example.com would not be matched against an allowed domain of example.com, causing the session to be rejected. It is highly recommended to transform eppn values outbound from your Identity Provider (IdP) to lowever case if at all possible. This eliminates inconsistent casing issues with scoped eppn values.

Resolution

A SAML assertion to our service should include an <AttributeStatement> section, with at least the required scoped eppn attribute included, that looks similar to the following. Note that urn:oid:1.3.6.1.4.1.5923.1.1.1.6 is the OID name string that corresponds to eppn. Supported attribute name formats are uri (preferred), basic or unspecified.

<AttributeStatement>

    <Attribute Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.6" 
      NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
        <AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">
          john.doe@example.com
        </AttributeValue>
    </Attribute>

    ... More SAML Attributes here as needed ...

<AttributeStatement>

Your home organization will need to identify why your account is missing an eppn (eduPersonPrincipalName) SAML attribute value and correct the issue. You can refer to the related Accepted SAML SSO Attributes article for more information about which SAML attributes our service requires, accepts, and the required formatting of these attributes.

Please contact your home organization's helpdesk and request assistance with this issue. Please include the entire contents of this page along with the details of your request.