Guest AAD B2B user can not sign into custom app

mcuziac 1 Reputation point
2020-01-22T16:34:36.167+00:00

I'm trying to build a custom app that uses Azure AD B2B to log users that are defined in multiple SAML Identity Providers.

I was able to add an Okta Idp and a guest user for that Idp. The user got the email and accepted the invitation - he was sent back to okta for signing in and everything seems to have worked ok.

He was later added to our custom app, but when he tries to sign in he gets an error message saying "This username may be incorrect. Make sure you typed it correctly. Otherwise, contact your admin."

Any idea what the issue might be?

Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
20,108 questions
{count} votes

1 answer

Sort by: Most helpful
  1. mcuziac 1 Reputation point
    2020-02-04T11:44:36.79+00:00

    Hi Frank

    I was able to find the actual error hidden in the html traffic. It was related to Azure AD not being able to read the email from the OKTA Saml Response.
    This seems to be caused by the fact that okta was not set up to send the email address as "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress".

    I'm still trying to find a way of doing this in Okta, as there doesn't seem to exist an out of the box way of doing it; I can add it as a custom attribute, but the only formats that are available are Unspecified, Uri Reference or Basic

    Mihai,

    0 comments No comments