Authentication Failed: Error validating SAML message : NameID element must be present as part of the Subject in the Response message, please enable it in the IDP configuration

This article explains how to address SAML authentication error: " NameID element must be present as part of the Subject in the Response message, please enable it in the IDP configuration"

Jul 2, 2019
Knowledge

Title

URL Name

authentication-failed-error-validating-saml-message-nameid-element-must-be-present-as-part-of-the-subject-in-the-response-message-please-enable-it-in-the-idp-configuratio

Article Number

000115730

Environment

Product: OpenEdge Version: 11.7.4 and later, 12.x OS: All supported platforms Other: SAML 2.0, ADFS

Question/Problem Description

SAML authentication fails with error: NameID element must be present as part of the Subject in the Response message, please enable it in the IDP configuration

Steps to Reproduce

Clarifying Information

PASOE application configured to use SAML 2.0 single-sign-on (SSO) authentication.

metadata\idp.xml reads:

<?xml version="1.0" encoding="UTF-8"?>
<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" entityID="<identity provider issuer  URL>">
    <md:IDPSSODescriptor WantAuthnRequestsSigned="false" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
        <md:KeyDescriptor use="signing">
            <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">;
                <ds:X509Data>
                    <ds:X509Certificate>MIIC5DCCAcygAwIBAgIQQh8xZbxCAKpHk......</ds:X509Certificate>
                </ds:X509Data>
            </ds:KeyInfo>
        </md:KeyDescriptor>
        <md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</md:NameIDFormat>
        <md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</md:NameIDFormat>
        <md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="<identity provider login URL>"/>
        <md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="<identity provider login URL>"/>
    </md:IDPSSODescriptor>
</md:EntityDescriptor>

Error Message

Client (eg web browser) returns error: Error: Server responded to <Service provider URL> with status code 401: Authentication Failed: Error validating SAML message : NameID element must be present as part of the Subject in the Response message, please enable it in the IDP configuration Service provider (PASOE) default.<date>.log reads: Error validating SAML message : NameID element must be present as part of the Subject in the Response message, please enable it in the IDP configuration

Defect Number

Enhancement Number

Cause

The nameID element is missing from the SAML assertion retrieved from the identity Provider (IdP).

Resolution

Configure the IdP so the nameID element is added to the SAML assertion. Using Active Directory Federation Services (ADFS) as the IdP:

Create an LDAP claim mapping email address to email address claim type

Create a transform rule mapping incoming email to outgoing NameID.

Select "Email" as the outgoing name ID format.

Workaround

Notes

Progress Article(s):

SAML authentication fails with error: Metadata for issuer <Identity provider issuer URL> wasn't found

References to Other Documentation:

“Troubleshooting SAML for ADFS.” ScreenSteps Help, help.screensteps.com/m/remote_authentication/l/841006-troubleshooting-saml-for-adfs.

Keyword Phrase

Last Modified Date

11/20/2020 7:01 AM

Authentication Failed: Error validating SAML message : NameID element must be present as part of the Subject in the Response message, please enable it in the IDP configuration

Files(0)

Was this article helpful?

Was this article helpful?

Authentication Failed: Error validating SAML message : NameID element must be present as part of the Subject in the Response message, please enable it in the IDP configuration

Information

Related Articles