Invalid response from SSO provider.

[rgifh]

I have sso configured and working for users using a enterprise application in Entra ID. I setup a seperate enterprise application for the DUO admin portal. I keep getting Invalid response from SSO provider. When I click the test button in the Entra application, it goes through just fine

[Ruben Cocheno]

@rgifh 

If you have a support contract with DUO, i probably would suggest you call them directly and work with the support on that as can be a variety of things really.

[Pulkit Mittal]

I suggest to give my answer a try before reaching out to support.

[Pulkit Mittal]

I have seen this issue before, This error is related to the User Identifier in Azure. Using Persistent NameIDs can sometimes result in the incorrect attribute being sent to Duo in the SAML assertion.

Go back to the Attributes and Claims section in Entra ID and enter user.mail as the Identifier.

To resolve this issue, use the following workaround as suggest by Duo: 

1. Log in to the Duo Admin Panel.
2. Click Administrators in the left sidebar, then click Admin Login Settings.
3. Scroll to the Single Sign-On with SAML Configuration section of the Administrator Login Settings page. 
4. Enable SSO by changing the "Authentication with SAML" setting to either Optional or Required. This will expose the rest of the SSO configuration form.
5. Change the Identity provider to Custom IdP.
6. Go back to the Attributes and Claims section in Entra ID and enter user.mail as the Identifier.
   
   

[rgifh]

I have tried this with no luck.