Notifications

585 views

Description

When SSO is enabled, some SAML request will fail with SAML2Error: SAML failed to login, Status code is urn:oasis:names:tc:SAML:2.0:status:Requester 

When checking the SAML response coming from the IDP you may notice this :urn:oasis:names:tc:SAML:2.0:status:InvalidNameIDPolicy" /></samlp:StatusCode></samlp:Status></samlp:Response>

 

Release or Environment

All versions

Resolution

The explanation and resolution in KB0657094 holds true.

Additional to this, from a ServiceNow perspective,  you can tackle this by changing the NameID policy in your IDP record.

Most of the times it would be

urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress.

Replacing it with

urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified

should give relief.

Also, unchecking "Create an AuthnContextClass" in the same IDP configuration does help.

 

You would still need to consult with your IDP admin and decide if the methods above are the ones that satisfy your business requirements.

A refresh of Claim Rules would be then desirable.

 

Article Information

Last Updated:2020-04-09 02:15:50
Published:2020-04-01