Identity Crisis: SAML Rejecting Improper URIs

Luke Hebert

March 29, 2022 - One minute read - 200 words

A SAML NameIdentifier declared as an entity format must contain a valid URI. When it does not, the application rejects the assertion and the user cannot sign in. The fix lives entirely in your identity provider configuration.

When launching your application from your identity provider, you may encounter the following error message:

ID4262: The SAML NameIdentifier '<user>' is of format 'urn:oasis:names:tc:SAML:2.0:nameid-format:entity' and its value is not a valid URI.

This error indicates that the SAML response received from your identity provider specified urn:oasis:names:tc:SAML:2.0:nameid-format:entity in the Format attribute of the saml:NameID element, but the content is not a valid URI.

This element of the SAML response contains the identifier of your user in your IdP. It may be your user’s username, email address, or other identifier.

By specifying urn:oasis:names:tc:SAML:2.0:nameid-format:entity in the Format attribute, you are indicating that this user identifier is a valid URI. However, the identifier specified is not a valid URI.

Resolution

To resolve this issue, do one of the following:

Change the Format attribute to urn:oasis:names:tc:SAML:2.0:nameid-format:persistent
Change the user’s identifier to a valid URI (look for extra spaces, quotes, hidden characters, copy/paste errors, etc.)

Either of these changes must happen inside the configuration of your organization’s IdP.

Security