SSO

[Bongjoo Kim]

Dear ,

I configued SSO to intergrate with other site .

when they try to use SSO in crowd , there is error message .

ERROR [saml2.profile.impl.AddNameIDToSubjects] Profile Action AddNameIdAction: Error while generating NameID

org.opensaml.saml.common.SAMLEml2.profile.impl.AddNameIDToSubjects] Profile Action AddNameIdAction: Request specified use of an unsupportable identifier format: urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress[saml2.profile.impl.AddNameIDToSubjects] Profile Action AddNameIdAction: Request specified use of an unsupportable identifier format: urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddressxception: The format to generate does not match the value configured

        at org.opensaml.saml.common.profile.AbstractNameIdentifierGenerator.generate(AbstractNameIdentifierGenerator.java:272)

Thanks,

[Anwesha Pan]

Hi @Bongjoo Kim 👋🏻

First of all, welcome to community! ✨

This error occurs because the Atlassian application expects a standard username to authenticate the user, but your Identity Provider (IdP) is attempting to send an Email Address format (urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress).

Crowd or the connected Atlassian app rejects this since it doesn't match the expected identifier format.

You can follow the below steps to resolve the error:

1. Update IdP: Log in to your IdP and edit the SAML application settings. Change the NameID Format.
2. Check Application Mappings in Atlassian: Navigate to the SSO Settings or User Profile mapping tab of your SSO plugin. Change the login/search Crowd user account setting from Email to Username.
3. Verify Crowd Application Access: If the user cannot log in after fixing the NameID, ensure they are explicitly allowed to access that application within Crowd.

I hope this helps & answers your question. 🙂

Thanks,
Anwesha