topic Re: Invalid response from SSO provider. in APIs

Invalid response from SSO provider.

rgifh — Tue, 27 Feb 2024 20:44:02 GMT

I have sso configured and working for users using a enterprise application in Entra ID. I setup a seperate enterprise application for the DUO admin portal. I keep getting Invalid response from SSO provider. When I click the test button in the Entra application, it goes through just fine

Re: Invalid response from SSO provider.

Ruben Cocheno — Tue, 27 Feb 2024 23:51:17 GMT

@rgifh

If you have a support contract with DUO, i probably would suggest you call them directly and work with the support on that as can be a variety of things really.

Re: Invalid response from SSO provider.

Pulkit Mittal — Thu, 29 Feb 2024 10:20:28 GMT

I suggest to give my answer a try before reaching out to support.

Re: Invalid response from SSO provider.

Pulkit Mittal — Thu, 29 Feb 2024 10:21:02 GMT

I have seen this issue before, This error is related to the User Identifier in Azure. Using Persistent NameIDs can sometimes result in the incorrect attribute being sent to Duo in the SAML assertion.

Go back to the Attributes and Claims section in Entra ID and enter user.mail as the Identifier.

To resolve this issue, use the following workaround as suggest by Duo:

Log in to the Duo Admin Panel.
Click Administrators in the left sidebar, then click Admin Login Settings.
Scroll to the Single Sign-On with SAML Configuration section of the Administrator Login Settings page.
Enable SSO by changing the "Authentication with SAML" setting to either Optional or Required. This will expose the rest of the SSO configuration form.
Change the Identity provider to Custom IdP.
Go back to the Attributes and Claims section in Entra ID and enter user.mail as the Identifier.

Re: Invalid response from SSO provider.

rgifh — Thu, 29 Feb 2024 15:06:31 GMT

I have tried this with no luck.