SAML integration with DLP Enforce passes authentication but fails authorisation

Products

• Data Loss Prevention Core Package
• Data Loss Prevention
• Data Loss Prevention Enforce

Issue/Introduction

You have configured your DLP Enforce server to authenticate via SAML as per: About authenticating users

On testing you see that the authentication step is succeeding but the Enforce server fails to locate a user for authorisation. 

Environment

DLP 16.x, SAML integration

Cause

The email address attribute being passed contained mixed case eg: [email protected] 

But the the email address to be matched for the user in the DLP Enforce was in lower case eg: [email protected]

Attribute matching is strictly enforced so no match was found in DLP to complete authorisation.

Resolution

Synchronising the records to match the email case resolved the issue.