SSO login failure - authenticated but not authorized based on 'authorized' param: False.

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• Users cannot long in via SSO
• /var/log/cb/coreservices/debug.log shows:

  • <warning> cb.flask.blueprints.api_routes_saml - torabam authenticated but not authorized based on 'authorized' param: False.

Environment

• EDR Server: All Supported Versions
• SAML SSO enabled

Cause

The authorized parameter in attr_map.py is not being met with the returned data

Resolution

If the user is expected to authenticate, verify that the expected authorized parameters are being sent over from the SAML provider

Additional Information

• Enabling debug logging will show what SAML response is sent over and verify if the expected field value was included. 
• The authorized parameter expectations can be modified in /etc/cb/sso/attr_map.py