EDR: Some Users Unable to Authenticate or Login with SSO Enabled

Products

• Carbon Black Hosted EDR (formerly Cb Response Cloud)

Issue/Introduction

• Some users are unable to authenticate or log in via SSO
• Coreservices log shows message

  <warning> cb.flask.blueprints.api_routes_saml - <username> authenticated but not authorized based on 'authorized' param: False.

Environment

• EDR Server: All Supported Versions
• SAML SSO Enabled

Cause

Logic in attr_map.py for the 'authorized' parameter is not being met for the user

Resolution

 Verify that the expected authorized parameters are being sent over from the SAML provider

Additional Information

• attr_map.py should show which field from the SSO/SAML reply is matched on
• Debug logging should help show what data is being sent over for the user request