Network Management

SAML logon fails with unknown user (Unable to authorize user user@domain.com with claim groups '. No matching SAML account or group was found)

Inn the SAML.log, , SAML Authorization failure with error message of "Unable to authorize user user@domain.com with claim groups '. No matching SAML account or group was found"

First published date

9/21/2020 5:26 PM

Last published date

6/16/2025 5:03 PM

Overview

When configuring SAML SSO integration, login is working for some users and groups but others are failing.

• The SAML group is on-premise with Azure
• The SAML group is added successfully
• Error is reproduced from Main and Additional Webs

In the OrionWeb.log or SAML.log, the following error message may appear:

Unable to authorize user XXXX@XXXX with claim groups 'XXXXXX'. No matching SAML account or group was found.

Use the Microsoft Entra debugging tool to find out more information regarding the SSO Attributes and Claims:
Debug SAML-based single sign-on - Microsoft Entra | Microsoft Learn

Product section

Orion Platform

Cause

This error message may occur when one of the following conditions are true:
  1. SAML account or group configuration is missing on SolarWinds Platform
  2. SAML IDP is not providing the group attribute in the SAML response properly because the claim is misconfigured.
  3. If the group membership for a user goes beyond the limit (more than 150 groups for SAML or 200 groups for JWT), groups are omitted from the token and a link to the Microsoft Graph endpoint to obtain group information is included instead in the attributes.

Resolution

To resolve this issue, perform the following steps:

Step 1: Add SAML account and group to SolarWinds Platform


To add SAML user or groups, refer to Create a SAML user or groups in SolarWinds Platform

Step 2: Confirm SAML groups are being sent as OrionGroups

Review the SAML.log to confirm if any groups are being sent.  If OrionGroups is missing, then no information will appear after claim groups in the log.
  1. Configure the group claim to use 'OrionGroups' in the namespace parameter
    1. Configure group claims for applications with Azure Active Directory
    2. https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-fed-group-claims
    3. (Section: Advanced options)
  2. To emit only groups assigned to the application, select Groups assigned to the application.
Screenshot that shows the Group Claims window, with the option for groups assigned to the application selected.

Reference: Configure group claims for applications by using Microsoft Entra ID - Microsoft Entra | Microsoft Learn