Cannot create authentication token (JWToken) for a SAML user. That SAML user disappears from Splunk, after performing the action

Applicability

Splunk Enterprise Splunk Cloud

Description

You have a Splunk instance integrated with a SAML IdP, that supports authentication JWTokens (Azure ADFS, or Okta at the moment). Most of your users are able to have the token generated, but some of them cannot. They see an error prompt that:

User "<SAML_USER>" does not exist.

And that user is no longer present and listed in Splunk users.

Investigation

Review if the problematic users have any special non-ASCII character in their user name. You can double check in Splunk internal logs if it is a root cause of the problem:
UnicodeEncodeError: 'ascii' codec can't encode character

Sample searches for particular IdP scripts:
Azure:

index="_internal" source="*splunk_scripted_authentication_azure.log" "*UnicodeEncodeError: 'ascii' codec can't encode character*"

Okta:

index="_internal" source="*splunk_scripted_authentication_okta.log" "*UnicodeEncodeError: 'ascii' codec can't encode character*"

Or search for SAML_script_azure.py/SAML_script_okta.py output accordingly.

Example log event for a user, that has 'í' special letter in her/his name, in the 10th letter of the name:

01-18-2022 12:25:21.497 +0000 ERROR ScriptRunner [24717 TcpChannelThread] - stderr from '/opt/splunk/bin/python3.7 /opt/splunk/etc/auth/scripts/SAML_script_azure.py getUserInfo': UnicodeEncodeError: 'ascii' codec can't encode character '\xed' in position 10: ordinal not in range(128)

Resolution

Reconfigure authentication extensions - set 'encodeOutput' to false.

encodeOutput (Optional) - If the Azure/Okta user's name contains special symbols and you don't want the authentication extension to encode its output.
false (default: true)

Related Links

https://docs.splunk.com/Documentation/SplunkCloud/latest/Security/ConfigureauthextensionsforSAMLtokens#Configure_authentication_extensions_for_the_Okta_identity_provider_in_Splunk_Web
https://docs.splunk.com/Documentation/SplunkCloud/latest/Security/ConfigureauthextensionsforSAMLtokens#Configure_authentication_extensions_for_Microsoft_Azure_using_Splunk_Web
https://docs.splunk.com/Documentation/SplunkCloud/latest/Security/ConfigureauthextensionsforSAMLtokens#Troubleshoot_authentication_extension_errors

Revision History

Revision	Publish Date	Comments
1.0	29-Sep-2026	Initial Release