Erro AADSTS51004 ao configurar integração do GSuite ao Office365

Question

Erro AADSTS51004 ao configurar integração do GSuite ao Office365

Murilo Melo 6

PT/BR
Estou tentando configurar a minha integração dos usuários do GSuite para usar o SSO no Office365.

Atualmente, já consegui gerar as ImmutableIds dos usuários manualmente, e inserí-las tanto nos usuários do office quanto nos usuários do GSuite via atributo personalizado; também alterei o antigo domínio @onmicrosoft.com para o meu domínio atual em todos os usuários, corrigindo e validando todas as nomenclaturas e dados.
Porém, o problema se dá após a autenticação na conta Google, onde o Office (ou Azure) não consegue encontrar o usuário em questão no diretório; entretanto, verifiquei o meu AD Azure, meus usuários no Office e comparei com os usuários no GSuite, e todos estão ok.

EN/US

I'm trying to configure my GSuite users integration to use SSO in Office365.

Currently, I've managed to generate the users' ImmutableIds manually, and insert them both in office users and in GSuite users via custom attribute; I also changed the old domain @onmicrosoft.com to my current domain for all users, correcting and validating all naming and data.
However, the problem occurs after authentication to the Google account, where Office (or Azure) cannot find the user in question in the directory; however, I have checked my AD Azure, my users in Office and compared them to users in GSuite, and all are ok.

Anshul Kumar (MINDTREE LIMITED) 6 Reputation points

2021-10-12T16:45:12.033+00:00

Hi, if the posted answer resolves your question, please mark it as the answer by clicking the check mark. Doing so helps others find answers to their questions.

1 answer

Your answer

Anshul Kumar (MINDTREE LIMITED) 6 Reputation points

2021-10-12T16:45:12.033+00:00

Hi, if the posted answer resolves your question, please mark it as the answer by clicking the check mark. Doing so helps others find answers to their questions.

Answer 1

Siva-kumar-selvaraj 15,721

Hello @Murilo Melo ,

Thanks for reaching out.

If you created a custom attribute to add the Office 365 Immutable ID to your Google users' profiles (as per these Steps), then did you select the custom attribute as Name ID as shown below? default Name ID configuration would be Basic Information > Primary email.

User's ImmutableID value must match with custom attribute that you were created and assigned to users in Google Workspace. You can use below PowerShell cmdlet to get user's ImmutableID which is assigned for non working user.

Get-MsolUser -UserPrincipalName ******@yourdomain.com | select ImmutableID, UserPrinciPalName

if you see any discrepancy then use following cmdlet to update ImmutableID Set-MsolUser -UserPrincipalName ******@yourdomain.com -ImmutableId ******@yourdomain.com

If you wish to take a deep dive into and see what NameID value being sent in SAML token from GSuite to Office 365, then use HTTP SAML tracker for troubleshooting plugin in chrome/firefox and capture trace while reproducing the issue so you could figure out actual NameID value sent in response as shown below, this value must match on Gsuite as well on Office 365 for given user sceanrio.

Here are some example from my Lab:

Created custom attribute in Gsuite:

Configured custom attribute as Name ID in Gsuite:

Added unique value (example: ******@thewebapp.in) to custom attribute for the user in GSuite and verified that same values (which is ******@thewebapp.in) updated for respective user object in Office 365 which match exactly.

I was able to login successfully.
In case if Gsuite sent incorrect NameID values which doesn't match with any of user object's Immutable ID then O365 gives below error same as you get above:

To learn more, refer : https://support.google.com/a/answer/6363817#ID&zippy=%2Cstep-configure-immutableid

Hope this helps.

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

Murilo Melo 6 Reputation points

2021-07-08T12:45:51.683+00:00

Hi, so I don't need to set the immutableId with a generated one from azure? (like the base64 string that many sites and some docs pages talk about)

I'll try to follow the steps above, and I'll let you know about the results, thanks mate :D
Siva-kumar-selvaraj 15,721 Reputation points

2021-07-09T07:01:00.017+00:00
its not necessarily base64 string always, Here are some details:

If users were created via Azure Active Directory sync, ImmutableID is an encoded version (base64 ) of the Active Directory objectGUID. For these users you use PowerShell to retrieve the ImmutableID from Azure AD and update same on Gsuite .
For example, to retrieve ImmutableID for all users and export to a CSV file: $exportUsers = Get-MsolUser -All | Select-Object UserprincipalName, ImmutableID | Export-Csv C:\csvfile

If users were created in Office 365 Admin console, ImmutableID would be blank by default. For these users, use any unique and simple value (such as UPN, email address, or Employee ID etc.., I used email address in my lab) set the ImmutableID in Office 365 Set-MsolUser -UserPrincipalName ******@yourdomain.com -ImmutableId ******@yourdomain.com.

Hope this helps.

------
Please "Accept the answer" if the information helped you. This will help us and others in the community as well.
Siva-kumar-selvaraj 15,721 Reputation points

2021-07-12T15:19:14.973+00:00

Just checking in to see if the answer helped. If this answers your query, please don’t forget to click "Accept the answer" and Up-Vote for the same, which might be beneficial to other community members reading this thread. And, if you have any further query do let us know.
Thanks, Siva
Murilo Melo 6 Reputation points

2021-07-12T23:39:42.17+00:00

I haven't been able to test yet, the validation period is close to the weekend in my sprint
Murilo Melo 6 Reputation points

2021-07-17T01:26:54.667+00:00

I've tried the steps above, but didn't work, I got an error at SSO login (before I've tried the steps, it asked me my google user and pass, then, redirected me back to microsoft)

This is the error I got now, already checked the urls and other vars that I've used on powershell to configure the SSO

Share via

Erro AADSTS51004 ao configurar integração do GSuite ao Office365

1 answer

Your answer