Error SAML mandatory attribute for user ID is missing

[HeshamKhja1]

Hi,

I configured SAML and it redirects successfully to Idp, but after user is authenticated with Idp and returned to Qlik Sense, Error 400 shows. In proxy audit logs the error says "SAML mandatory attribute for user ID is missing". The logs also show that SAML attributes are empty.

I inspected the SAML Response using SAML Tracer, and indeed the attributes tag in the SAML XML is not there. However, the NameID tag is present. Why is Qlik Sense unable to read the NameID as SAML user ID?

The NameID exists in the response under <saml2p:Response> <saml2:Assertion> <saml2:Subject> <saml2:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"> XXXXX</saml2:NameID>

SAML Configuration:

I disabled optional attributes and single log out just as an attempt to resolve the issue.

I tried SAML attribute for user ID "NameID" and "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name" but both return the same error.

Any ideas please?

[hugo_andrade]

Hi @HeshamKhja1 ,

It's most likely a mismatch between your IdP and Qlik Sense.

Could you send the SAML assertions here so we can inspect and validate your configuration?

With that, we will be able to help you.

[Levi_Turner · Accepted solution]

Qlik Sense Enterprise - Client Managed reads from the attribute statement in the SAML XML response, not from the subject statement. 

[Leonds1998]

This error means a required user ID attribute is missing from the SAML response, which can be fixed by correcting attribute mappings on the Identity Provider (IdP) or verifying user data. First, ensure the SAML response contains the mandatory attributes, such as emailaddress or nameid, by checking your IdP's configuration and your service provider's settings. If the attributes are correctly mapped, update the user's profile with the missing data and re-upload the IdP's metadata file if its configuration has changed.

TM Menards

[HeshamKhja1]

Hi @Levi_Turner ,

Thank you for your input. I have a further inquiry if you would kindly help.

After investigating with the Idp admin, he informed me that no attributes are returned because of the flags below sent by Qlik Sense in the SAML Request. He requested that we remove these flags from the request. Is this possible? or do you have any alternatives/suggestions?
AssertionConsumerServiceIndex="1"
AttributeConsumingServiceIndex="1"

On a side note, your posts and replies are always a great source of information and they benefit me a lot. So thank you a lot.

Regards,

Hesham