Troubleshooting Enterprise Federation for Administrators

We offer a list of common problems that can occur with enterprise federation in Omnissa Connect and we outline suggested troubleshooting steps.

Best practices

Follow the listed best practices when troubleshooting enterprise federation issues for Omnissa Connect administrators.

Always verify attribute names and case sensitivity.
Ensure mandatory attributes are present in SAML responses (email, firstName, lastName, and userName).
Use an unspecified authentication method for Microsoft Entra ID.
Regularly check and update SAML Signing certificates.
Maintain consistent NameID format and NameID values.
Communicate configuration changes promptly to avoid login failures.

Omnissa Community help with attribute mappings

See the article How to Troubleshoot and Optimize Attribute Mappings for Identity Service and Enterprise Federation for help with attribute mapping.

Microsoft Entra ID issues

View some possible issues that might arise while configuring enterprise federation with the identity provider Microsoft Entra ID.

Attribute Namespace issues

Issue: Omnissa Access does not support Namespace definitions for attributes. When configuring enterprise federation using Entra ID, you cannot leave the Entra ID-specific Namespace in attribute definitions.
- Fix: Remove the attribute Namespace from the attribute definitions in Entra ID.
Issue: Often, Namespace definitions in Entra ID create incorrect claims during federation configuration.
- Fix: Ensure that attributes are defined without Namespace.
- Examples:
  - Incorrect formats
    - Claim name: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress → Value: user.mail
    - Claim name: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname → Value: user.givenname
    - Claim name: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name → Value: user.userprincipalname
    - Claim name: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname → Value: user.surname
  - Correct formats
    - Claim name: Unique User Identifier (Name ID) → Value: user.userPrincipalName
    - Claim name: email → Value: user.mail
    - Claim name: firstName → Value: user.givenName
    - Claim name: lastName → Value: user.surname
    - Claim name: userName → Value: user.userPrincipalName

Authentication method issues

Issue: An admin defines a specific authentication context ( urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport). If a user does not use the specified method, authentication fails.
- Example error message:
```
Sorry, but we’re having trouble signing you in. 
AADSTS75011: Authentication method 'Password, MultiFactor' by which the user authenticated with the service doesn't match requested authentication method 'WindowsIntegrated'. Contact the Microsoft Entra SAML Toolkit application owner.
```
- Fix: Always define the unspecified authentication method for successful logins (urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified).

Invalid Authentication Method Configuration in Omnissa Connect

Issue: The Omnissa Access tenant configuration needs updating.
- Incorrect example: Microsoft Entra ID SAML IdP Method | SAML Context: urn:oasis:names:tc:SAML:2.0:ac:classes:Kerberos
- Fix: Update the Omnissa Access tenant to the correct settings.
  - Correct example: Microsoft Entra ID SAML IdP Method | SAML Context: urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified | Description: Enter Auth Method description…

General issues

View some possible issues that might arise while configuring enterprise federation.

Attribute case sensitivity

Issue: Attribute names in Omnissa Access are case-sensitive.
- Fix: Use the documented case for attribute names as outlined in Managing User Attributes in Omnissa Access.

Mandatory attributes

Issue: Omnissa Access assumes four attributes as mandatory; email, firstName, lastName, and userName. Missing any of these four attributes causes the JIT provisioning to fail.
- Fix: Ensure all of the four listed attributes are sent in the SAML response.

Missing attributes in the identity provider (IdP)

Issue: Some accounts do not have mandatory attributes.
- Fix: Audit the IdP record for the missing attributes (email, firstName, lastName, and userName) and map them.
- Audit record API example
```
"message": "Failed to save jit user" 
"success": "false" 
"successAuthMethods": "WS1 SAML IdP Method" 
"isForceAuth": "false"
```

Name ID format mismatch

Issue: The NameID format in Omnissa Connect does not match the NameID format in the IdP's SAML response.

Fix: Ensure both systems use the same NameID format.
Example expected format: urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified
Audit record example

{ 
    "failedAuthMethods": "[{ 
        \"reason\": \"AUTHENTICATION_FAILURE\", 
        \"authMethod\": \"<IDP_NAME>\", 
        \"failureMessage\": \"Unable to resolve user identity from SAML response subject, IDP[id: <IDP_UUID>, name: <IDP_NAME>], configured format mapping: {urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified: userName}, subject format in SAML response: urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress\" 
        }]", 
    "authMethods": "SAML", 
    "message": "Authentication failed." 
}

Name ID value not sent

Issue: If the NameID value is absent in the SAML response, logins fail.
- Fix: Ensure to include the NameID value attribute.

SAML signing certificate expiry

Issue: Expired certificates cause signature errors.
- Fix: Update the IdP metadata with new certificates.

Omnissa Connect deactivated

Issue: If Omnissa Connect is deactivated or if configurations have changed without communication to others, federation logins fail.
- Error message examples:
  - "Failed to retrieve metadata for [Tenant: TenantName, URL: https://idp.example.com/saml/metadata/uniqueGUID, Status: 400 , Message: Bad Request]" } }
  - "message": "Failed to retrieve metadata for [Tenant: TenantName, URL: https://idp.example.com/app/applicationID/sso/saml/metadata, Status: 404 , Message: Not Found]" }
- Fix: Activate Omnissa Connect or restore the original configurations.

Other possible issues

Problem	Description
Log in validation failure with Error (4xx).	Review the federation setup configuration for the following: - Check if the identity provider is set correctly in the Service Provider configuration. Make sure that the Name Identifier is sent correctly in the SAML response. Note: To verify the information in the SAML response, you can use a SAML-tracer browser extension. First, look at the SAML request to see what are the requested attributes. For example, `NameID` format. Next, look at the SAML response and search for the `NameID` format there. The two must match. - Check if the Name ID Format and Authentication Methods are set correctly in the identity provider configuration of the Configure Identity Provider step. - Check if the value for User Identification Preference is set correctly in the Configure Identity Provider step. The User Identification Preference setting is what you enter in the Omnissa Connect console login page and can be one of the following: user@domain, Email, or UPN. - Check if the user who initiated the Validate Login flow is synchronized in the Sync groups and users step.
User Auth Service and Directory Sync Service not running after successful installation of the Omnissa Access Windows connector.	Check the Omnissa Access tenant configuration: - Ensure you can ping the Omnissa Access tenant from the Windows or virtual machine where you installed the Omnissa Access connector. You can get the Omnissa Access tenant URL from the description of the Management Organization for your enterprise. - Ensure that access to the Omnissa Access tenant is not blocked and that `*.workspaceoneaccess.com` is added to your enterprise firewall allowed list. - Check if you are using a Proxy. If so, you must rerun the installer selecting the Custom installation option and provide the Proxy details during the installation. - Check the Omnissa Access connector logs for errors. To view the User Auth service log, open `INSTALL_DIR\Workspace ONE Access\User Auth Service\logs\eas-service.log`. To view the Directory Sync service log, open `INSTALL_DIR\Workspace ONE Access\Directory Sync Service\logs\eds-service.log`.
Opening some steps of the self-service federation workflow takes too long and eventually result in Error 500.	If you are using a browser in incognito mode, you can either check your browser's settings and ensure that "Block third-party cookies" is not selected, or switch to non-incognito browser mode.
It takes too long to perform an operation in the Enterprise Federation dashboard and results in Error 500.	If you are using a browser in incognito mode, you can either check your browser's settings and ensure that "Block third-party cookies" is not selected, or switch to non-incognito browser mode.
Omnissa Access connector sync fails.	Group and user sync can fail if: - There is a network issue that interrupts the connection between the connector and the Active Directory. - Bind User credentials (Bind DN/passwords) have changed. - Bind User password has expired.
User login redirects to My Omnissa instead of your corporate identity provider.	If users are logging in from corporate domains or subdomains that are not registered for federation with Omnissa Connect, they are redirected to My Omnissa. Login with your corporate identity provider is possible only for the domains that have been registered for federation.
Domain verification fails.	Domain verification may fail if the domain is a private and not a corporate domain. If you want to federate a private domain, you must file a support ticket.
Post federation, users cannot see the services in their organization.	Existing users with federated domains used to access the services in their organizations by logging in with their My Omnissa account. After federation is activated, synced users must link their corporate account to their Omnissa ID. Only when the two accounts are linked, do services become visible and accessible to the existing users, based on the Organization and Service role access they have in the organization.

Get Support

Use the Home page in Omnissa Connect to access Customer Connect for your support requests. In Omnissa Connect, go to Home > Resources and select the Customer Connect tile.

You file support requests in Customer Connect when there are issues with your current setup that you are unable to fix through the Enterprise Federation dashboard, or when you want to perform one of the following operations:

Remove a domain or subdomain that is already added to your federation setup.
Undo federation for all domains and subdomains.
Make changes to the identity provider configuration, such as switch to a different identity provider or change the user identification preference.

To file a support request for enterprise federation, make sure you are logged in as an Owner or an Enterprise Administrator in the Management Organization for your enterprise.

Was this page helpful?