Getting error below when testing SAML with Azure AD

Getting error below when testing SAML with Azure AD - NPM version 2018.4 HF1

Groups claim 'OrionGroups' is missing. This claim is required for authorization via SAML groups and has to be configured in your Identity Provider Individual users are working but not groups which is our preferred way of give role based access. Anyone see this problem and have a solution on how to setup the group claim in Azure AD? Any help is appreciated

Find more posts tagged with

azure ad

saml

Accepted answers

All comments

Littlebee_26

Azure ADFS is not yet supported in the current version of Orion Core 2018.4.

kzin

Feature Request please.

christopher.t.jones123

take a look at this SAML Single Sign-on its a guide of it SAML setup in Okta, but in the comments there are users that have worked out issues to groups

kzin

Thank you for the reference

That is the same error that I am getting, but I am not sure as to the resolution. AzureAD has a few other options that may be impacting this. Example:

- By default, each claim name has a namespace of "http://schemas.microsoft.com/ws/2008/06/identity/claims/ ". Does this need to be removed?

- The setting Groups returned in claim is changed to be named "OrionGroups" as outlined in the notes of the link you sent, however there are options.

-- Which groups associated with the user should be returned in the claim (None/All Groups/Security Groups/Distribution Lists/Directory Roles)

-- Source attribute (group ID/sAMAccountName/NetBIOSDomain\samAccountName/DNSDomain\samAccountName/On Premises Group Security Identifier)

-- Please note: I get the error that the group claim is missing, unless I set it to "source attribute group security identifier", but setting it this way still leaves me with the error User ID 'user.id@domain.name' has not been matched to any SAML individual account or SAML group.

Does the group "OrionGroups" have to exist in AD?

Do I need to set up anything under Orion > Settings > All Settings > Manage Accounts > SAML Groups ?

Do these need to be mirrored on Active Directory?

cory.chandler

Not sure if you were able to fix this but here are the User Attributes and Claims I put into AzureAD. The key is the OrionGroups claim name and Value of user.groups. Hope that helps. I had a case opened for this 00246403 and was helped by Alvhin. It's working for us now. Hope this helps.

nishil09

How to step-up the groups in the Solarwind. Is the hostname.domina and than groupname in the solarwind SMAL group sectoin?

cancerian211

Appreciate if you can share the full configuration uder user.groups

Kita

There are two different scenarios to considered for Azure groups:

Groups created directly in Azure AD
Groups which are synced from On-Premise AD using Azure AD Connect

The information is based off of the Microsoft documentation at: https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-fed-group-claims

The short version is groups created directly in Azure AD will always appears as the group id. This is a limitation from Microsoft. The only solution today would be to manually add the group id to SAML groups. If the group(s) are synced from On-Premise AD, then optional claims must be configured (default is group id). Once the optional claims is configured, the group will be provided as the sAMAccountName.