SAML Identity Provider user log in issues

Summary

This knowledge base article outlines several scenarios that may occur when a SAML-based Identity Provider is utilized to handle login requests for N2W.

Description

Scenario 1

A user attempts to log in to the N2W user interface while being a member of the cpm_<groupname> group in the Identity Provider; however, the corresponding group does not exist in N2W.

Upon attempting to log in to N2W, the following error message will be displayed in the GUI:

The following error message can be found in the cpm_server.log:

ERROR:  login_error(directory_service_utils.py:549)  Login failed (user 'CPMLAB\cpmuser2'). Group 'group22' doesn't exist 

Scenario 2

A user is simultaneously a member of more than one "cpm_" group in the Identity Provider.

The following error message will be displayed in the N2W GUI:

The following error message can be found in the cpm_server.log: ERROR:  login_error(directory_service_utils.py:549)  Login failed (user 'CPMLAB\cpmuser3'). The user must be a member of a single IdP group with permission to use N2W 

Scenario 3

A user who is not a member of any group attempts to log in to N2W, or an incorrect group membership claim has been configured.

The following error message will be displayed in the N2W GUI:

The following error message can be found in the cpm_server.log:

ERROR:  login_error(directory_service_utils.py:549)  Login failed (user 'CPMLAB\cpmuser4'). User not authorized to use N2W. Possible cause - missing or invalid 'group membership claim' 

Resolution

Resolution for Scenario 1:

To resolve this issue, create the corresponding group in N2W.

Resolution for Scenario 2:

Please verify whether the user is a member of more than one "cpm_" group in the Identity Provider. Assigning a user to multiple groups is not permitted.
 

Resolution for Scenario 3:

Please verify that the user is a member of one of the “cpm_” groups in your Identity Provider, and ensure that the group membership claim has been configured correctly.