SAML U-M Shibboleth SSO - Error: "Saml response does not contain group information".

Applicability

Description

SAML SSO Error: "Saml response does not contain group information" — All Attributes and Mapping Verified

No value found in SamlResponse for match key=saml:AttributeStatement/saml:Attribute attrName=isMemberOf err=No nodes found for xpath=saml:AttributeStatement/saml:Attribute

Investigation

Splunk Cloud SAML SSO logins succeeded, but no group-based role mapping occurred and debug logs showed errors like:

No value found in SamlResponse for match key=saml:AttributeStatement/saml:Attribute attrName=isMemberOf err=No nodes found for xpath=saml:AttributeStatement/saml:Attribute

The U-M IdP confirming attribute release, to find isMemberOf, mail, or other user attributes in the assertion.

Technical Cause -

U-M Shibboleth (and many higher education IdPs) release SAML attributes using OID URNs in the“Name” field, not the "human-friendly" name.

For example:

<saml2:Attribute FriendlyName="isMemberOf"
   Name="urn:oid:1.3.x.x.x.1.5923.x.x.x.1"
   NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
  <saml2:AttributeValue>ISR Splunk Access</saml2:AttributeValue>
  <saml2:AttributeValue>ISR Splunk Admins</saml2:AttributeValue>
</saml2:Attribute>

Splunk Cloud’s default SAML configuration looks for the literal attribute name entered in the “Role alias” field.

If you enter isMemberOf (or mail/displayName) as the Role/Mail alias, Splunk cannot find any attributes because the assertion's “Name” is the OID, not the friendly name.

Resolution

Set “Role alias” and Other Attribute Aliases Using OID URN Names:

urn:oid:1.3.6.1.x.x.5923.x.x.x.1

urn:oid:0.x.2342.19200300.xxx.x.x

urn:oid:2.16.840.x.113730.x.x.241

Mapped group names as usual
In SAML Group mapping, use the actual group values released by Shibboleth (e.g., is splunk admins), lowercased as required by Splunk Cloud.

Retested login:
As soon as the Role alias is set to the correct OID URN rather than the friendly name, Splunk Cloud immediately began seeing attributes and assigning roles correctly.