Troubleshoot Saml Nameid Attribute Mapping

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

A security engineer is troubleshooting a newly deployed SAML 2.0 single sign-on (SSO) integration between an external Identity Provider (IdP) and Cloud Identity for workforce access to Google Cloud.

During testing, provisioned users authenticate successfully at the external IdP login screen. However, upon being redirected to Google Sign-In, the authentication process fails and returns an identity resolution error. A review of the SAML response XML and directory settings reveals the following:

The SAML assertion contains a element with the value John.Doe@example.com.
The Cloud Identity directory has the user account configured with the primary email address john.doe@example.com and an email alias jdoe@example.com.
The SAML assertion payload also passes an attribute claim email set to john.doe@example.com and a groups claim containing gcp-engineers.

What is causing this authentication failure, and how should it be resolved?

The assertion is failing because Google Sign-In requires the user's alias email address jdoe@example.com to be passed in the NameID field when secondary aliases exist; update the IdP claim mapping accordingly.

Cloud Identity evaluates only the NameID value against the user's primary email address and enforces case sensitivity; modify the IdP claim mapping or transformation to emit the exact lower-case string john.doe@example.com in the NameID element.

Cloud Identity ignores the NameID element and requires the user's email identity to be supplied in a custom SAML AttributeStatement named email; reconfigure the IdP to map the primary email to this attribute.

The external IdP is signing only the SAML assertion rather than the entire SAML response; reconfigure the IdP to sign both the SAML response and the assertion using SHA-256.

Professional Cloud Security Engineer

Troubleshoot Saml Nameid Attribute Mapping

Related questions