Azure-Specific Fix: ERROR: "SAML response does not contain group information." Using Microsoft Azure AD as the Identity Provider

Applicability

Description

1. Using Microsoft Azure AD as the Identity Provider (IdP)  for SAML logging in to Splunk.

2. Recently, a few users reported being unable to log in to Splunk.

3. Message received:-

saml response does not contain group information.

4. Other members of the same AD group can log in to Splunk without any issues.

5. The issue happens to a few users in different AD groups.
 

To ensure that the token size doesn't exceed HTTP header size limits, Azure AD limits the number of objectIds that it includes in a groups claim. If a user is a member of more groups than the average limit (150 for SAML tokens, 200 for JWT tokens), then Azure AD does not emit the groups claim in the token. Instead, it includes an overage claim in the token that indicates to the application to query the Graph API to retrieve the user's group membership

Investigation

1. The issue generally occurs when the user is a part of more than 150 AD groups.

2. The following errors found in the $SPLUNK_HOME/var/log/splunk/Splunkd.log confirm the issue.

ERROR Saml - No value found in SamlResponse for match key=saml:AttributeStatement/saml:
Attribute attrName=http://schemas.microsoft.com/ws/2008/06/identity/claims/groups 
err=No nodes found for xpath=saml:AttributeStatement/saml:Attribute.

3. First enable all the DEBUG logs for SAML.
 

splunk $ splunk set log-level Saml -level DEBUGsplunk $ splunk set log-level AuthenticationManagerSAML -level DEBUGsplunk $ splunk set log-level UserManagerPro -level DEBUG

4. Then verify whether the Metadata.xml has the group attributes in the SAML response.

Check whether the following attribute is present or not:-

attrName=http://schemas.microsoft.com/ws/2008/06/identity/claims/groups

 
5. If the above attribute is present then it is a case of Splunk not getting the group information from IDP.


 

Resolution

To fix the issue, reduce the group memberships for the users facing the issue.
If the above workaround is not feasible please follow the below procedure
In Azure AD
1. Go to Azure AD and select "App Registrations"
2. Click on "All applications" and find the "Splunk Enterprise and Splunk Cloud" app
3. Select and update the Manifest

The current Manifest will have something similar to (GROUP_ID is a Azure Object ID below,)

"appRoles": [
{
"allowedMemberTypes": [
"User"
],
"description": "msiam_access",
"displayName": "msiam_access",
"id": "XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX",
"isEnabled": true,
"lang": null,
"origin": "Application",
"value": "null"
}

Create an appRole for each AD group that is currently used. Somethings to note... The displayName can't have any spaces. Also, the id is an Azure object ID that needs to be generated. It should not be currently used and must be unique. The "value" field was made the same as the displayName.

Below is an example.
 

{
"allowedMemberTypes": [
"User"
],
"description": "Server Operations and Engineering",
"displayName": "SystemEngineer",
"id": " XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX",
"isEnabled": true,
"value": "SystemEngineer"
}

If there is more than one appRole, use put a comma after each definition until the last one. Again, the "id"s are unique object ids in Azure. See the example below

{
"allowedMemberTypes": [
"User"
],
"description": "Server Operations and Engineering",
"displayName": "SystemEngineer",
"id": " XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX",
"isEnabled": true,
"value": "SystemEngineer"
},
{
"allowedMemberTypes": [
"User"
],
"description": "Network Operations and Engineering",
"displayName": "NetworkEngineer",
"id": " XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX",
"isEnabled": true,
"value": "NetworkEngineer"
}

Save the Manifest

1. Go to Azure AD go to the Enterprise applications and select Splunk Enterprise and Splunk Cloud
2. Select "Users and groups"
3. For each defined Group, edit it and select one of the roles created before.  If needed do the same for users, if not only using AD Groups

On Splunk Enterprise / Cloud

1. Go to Settings>Access Controls and select Authentication Method
2. Click the Reload Authentication configuration button.
3. Test.

 

Related Links

External Documentation:
Using Application Roles
Azure-ad-application-roles-essentials

Details on Azure AD group sending behavior
Azure Active Directory now with Group Claim and Application

Configure extensions for the Microsoft Azure identity provider