Setup of G Suite IDP for SAML direct federation for B2B

Name 1

We want to enable guest users for a particular domain to login with their G Suite accounts. We setup the direct federation, but invitations are not redeeming.

We can see when the user accepts the invitation, the user is passed to G Suite, authenticated, passed back to Azure, but then get's the message:

Invitation redemption failed
An error has occurred. Please retry again shortly.

It seems then the SAML response from G Suite to Azure is broken. Either the SAML response is malformed or Azure isn't processing the response correctly.

Any ideas?

AmanpreetSingh-MSFT 56,741 Reputation points

2020-03-12T06:58:42.257+00:00

@Name could you please share the correlation id and timestamp?
Name 1 Reputation point

2020-03-13T02:35:04.26+00:00

Correlation Id:28288f28-051b-4af4-8189-06c739031838
Timestamp:2020-03-13 02:34:38Z

3 answers

AmanpreetSingh-MSFT 56,741 Reputation points

2020-03-19T07:56:06.283+00:00

@Name I tried to fetch the details from our backend database based on the correlation ID and timestamp but I was not able to find any records.

If you're still having an issue here, please email AzCommunity[at]microsoft[dot]com and I can enable a one time free support ticket. Please provide your Azure Subscription GUID and a reference to this thread. And hopefully we can get you on the right path again soon.

In addition to that once you are able to resolve your issue with the support engineer, please post your response on this thread so that future readers will be able to benefit from your solution.
Please sign in to rate this answer.
Ross, Phil 1 Reputation point

2020-05-28T13:15:45.57+00:00

We are about to try configuring Direct Federation between our sandbox Azure AD and G suite IdPs. Do you have any information on the issue posted here?

AmanpreetSingh-MSFT 56,741 Reputation points

2020-05-29T13:59:52.453+00:00

@Ross, Phil The problem was with Attribute mapping in GSuite IDP.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
GV 1 Reputation point

2020-04-21T14:24:20.023+00:00

@Name Did you solve your issue? If yes, how?

Thanks
Please sign in to rate this answer.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
gaurav_2626 1 Reputation point

2020-06-06T18:07:27.933+00:00

Hi. I've been trying to implement a similar configuration. Can you please help me with how the SAML app is to be setup at the g-suite end.
Please sign in to rate this answer.
gaurav_2626 1 Reputation point

2020-06-06T18:08:03.317+00:00

@Name

gaurav_2626 1 Reputation point

2020-06-06T18:10:42.34+00:00

@GV Can you also help me if you have figured a solution?

GV 1 Reputation point

2020-06-08T07:41:46.037+00:00

Hi Guys,

I was able to configure federated login, but direct SSO from G Suite Apps is still broken: Azure support guys said it's a Google fault but I hadn't time to deep dive it with G Suite support team.
My G Suite SAML App config:

ACS URL: https://login.microsoftonline.com/XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX/saml2
Entity ID: urn:federation:MicrosoftOnline
Attribute Mapping
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress -> Basic Information -> Primary Email

where XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX is your Tentant ID (you can find it from Overview dashboard).
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Setup of G Suite IDP for SAML direct federation for B2B

3 answers

Your answer