nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

ArcGIS AGOL Unable to Login Using IDP Error Parsing 'NAME_ID' from SAML Reponse

AlexStevenson

This issue started today where on occasion just signing into AGOL via web browser or through the Navigator for ArcGIS app, we will get this error. Then it mysteriously goes away. I contacted our guy that works with ADFS and he said that he doesn't see any issues or errors on our end. But there seems to be an issue going on between our enterprise identity provider and AGOL's Portal for ArcGIS.

Is anyone else experiencing this issue recently where it was working normally beforehand?

Find more posts tagged with

Accepted answers

All comments

AlexStevenson

Hi Danny,

I'll also be using the SAML Message Decoder. Thanks for mentioning it!

I checked the Edit Identity Provider settings and it appears we do not have Encrypt Assertion enabled.

I'm checking with our ADFS admin to make sure we are including the 4 User Attributes for outgoing claim types as mentioned in the article you mentioned. A couple of questions on this - if we make a change to the ADFS mapped attributes, say that attributes are added, will that affect the existing SAML-based users in AGOL? And, will that require an update with our IDP?

Thanks,

Alex

DanielUrbach

Alex,

I only mentioned Firefox because up until a few minutes ago, every Chrome extension I tested wouldn't actually capture the SAML traffic from AGOL (this is due to the fact that we open a second tab for the SAML interactions). It looks like the "SAML Message Decoder" extension does work and it's what I will be using moving forward!

Either way, can you confirm if your organization is indeed using encrypted assertions? You could check the "Edit Identity Provider" settings in your organization's security settings page to confirm this. If so, this would explain why you didn't see "nameid" in the SAML response, as it would be encrypted. If this is the case, as a test you might turn off encrypted assertions there and have your ADFS admin temporarily disable them on the ADFS side, then capture the SAML response from a failed login attempt.

An easier first step may be to simply re-establish the relying-party trust between AGOL and ADFS. It's generally pretty painless and won't affect the SAML-based users you have already created in AGOL, so long as the attributes currently mapped in ADFS remain the same. See Configure Active Directory Federation Services—ArcGIS Online Help | ArcGIS for details on how to do this.

-Danny

AlexStevenson

Hi Daniel,

Thank you for the response.

I don't have Firefox but I did see that there's a SAML Tracer for Google Chrome. I installed that extension, logged out of AGOL and logged back in. No issues this time around with logging in. I looked at the SAML extension logs but did not find any attribute with "Nameid" or "Name_ID" in the response data tab. I also exported the SAML logs (it exports as a .json file) and did a search in there for NameID but it didn't return anything.

I have confirmed that this is happening to other users as will and with the mobile app Navigator for ArcGIS.

Thanks,

Alex

DanielUrbach

Alex,

That error generally indicates that the Portal (or AGOL) did not receive a nameID attribute in the SAML response sent from your ADFS.

If you happen to have Firefox, you can install a handy SAML troubleshooting tool called SAML Tracer, which will let you view the SAML response that is sent back upon authentication with ADFS (the SAML response and request are denoted in SAML Tracer with an orange "SAML" tag on the right side of the window. Looking at that SAML response after getting this error, do you see the NameID attribute? If not, it indicates that ADFS is not sending that attribute and in that case it might be worth having your ADFS admin take a look at the Windows Event logs for that ADFS machine. It's probably also a good idea to confirm if this is happening to other users as well, or just your user, as that might help your ADFS administrators to narrow down the issue.

Do you have multiple ADFS instances behind a load-balancer? Because of the intermittent nature of the issue, it could indicate that one of the instances may not be handling requests properly.

-Danny

Join the Conversation

Signed in members can post, follow updates, and more. New here? Register a free account.

Quick Links

Community Help
Find useful guides, FAQs, and documents to help you navigate and make the most of Esri Community.