Email Security.Cloud SSO Error "Email could not be fetched from SAMLResponse"

Products

• Email Security.cloud

Issue/Introduction

When attempting to log into the Broadcom Security.cloud (ClientNet) portal or quanatine portal via Single Sign-On (SSO), users are redirected back to the login portal without being signed in. No explicit error message appears on the screen, but a browser network trace or SAML inspect tool reveals the following error query parameter:

error_description=Value+of+Identity+Subject+Claim:+'Email'+could+not+be+fetched+from+SAMLResponse

Environment

Email Security.Cloud integrated with Azure for SSO

Cause

This issue occurs because Microsoft Entra ID (Azure AD) appends a default URI namespace (e.g., http://schemas.xmlsoap.org/...) to the attribute names sent in the SAML assertion. Broadcom Security.cloud expects clean, case-sensitive attribute strings (like Email, FirstName, LastName) without any URL prefixes. Because of the namespace mismatch, Broadcom cannot find the required user identifiers.

Resolution

Step 1: Access Attributes & Claims in Entra ID

1.  Log in to the Microsoft Entra admin center.

2. Navigate to Identity > Applications > Enterprise applications.

3. Search for and select your Broadcom Security.cloud / Email Security.cloud application.

4. On the left menu, click Single sign-on.

5. Locate the Attributes & Claims section and click Edit.

Step 2: Clear namespaces for required claims

You need to modify the claims so that they do not transmit a namespace prefix.

1. Click on the Email claim to edit it.

2. Locate the Namespace field and delete its contents entirely (leave it completely blank).

   • Note: Ensure the Name field is set exactly to Email and is not duplicated into the namespace.

3. Click Save.

4. Repeat this exact process for the FirstName and LastName claims:

   • Click the claim > Delete everything in the Namespace field > Click Save.

Step 3: Verify the configuration

Once updated, your Additional claims table should display clean claim names without any URL prefixes or slashes, matching this layout:

Claim Name	Namespace	Value
Email	[Blank]	user.mail
FirstName	[Blank]	user.givenname
LastName	[Blank]	user.surname

Validation

1. Close your browser entirely or open a new Incognito/InPrivate window.

2. Navigate to your Broadcom Security.cloud portal login link.

3. Authenticate via Entra ID. The login should now succeed, routing you cleanly into the dashboard.