Anyone familiar how to fix user doesn't exist in product SAML assertion?

[Tom L]

Recently, after our Crowd upgrade, there are several users who cannot login to Confluence data center with the following error:

2020-09-08 14:18:03,019 ERROR [http-nio-8090-exec-11] [impl.web.filter.ErrorHandlingFilter] doFilter Received SAML assertion for user (username), but the user doesn't exist in the product
com.atlassian.plugins.authentication.impl.web.usercontext.AuthenticationFailedException: Received SAML assertion for user (username), but the user doesn't exist in the product

The user exists in Confluence, and can be found via the API. The user exists in Crowd and can be found in the delegated authentication directory. The user also exists in the IdP.

Any ideas how to resolve this?

[Arnav Ghatage]

Hi Tom,

It seems like the plugin you are using on confluence, does not have Just-In-Time provisioning or remote directory sync or an option to change user identifier in the SSO configuration. Crowd send SSO user's username in NameID SAML attribute which confluence uses to identify SSO users but it seems it is unable to find any user in confluence with received NameID value. You can try out this plugin: Confluence SAML SSO. This add-on allows you to test configurations and see all the attributes received in the SAML response. Also, can use the different SAML Attributes to identify SSO user if required.

Feel free to ask me any more questions that you have.

I work for miniOrange, a top SSO vendors in the Atlassian Marketplace. Reach out to us via atlassiansupport@xecurify.com

 
Thanks,
Arnav