SAML throws error: U00045669 No matching EntityId after Automation Engine upgrade to 24.4.5

Products

• Automic Automation
• Automic SaaS
• CA Automic One Automation
• CA Automic Operations Manager
• CA Automic Workload Automation - Automation Engine

Issue/Introduction

When logging in to the Automic Web Interface via SAML-MFA (such as EntraID) after upgrading to Automation Engine version 24.4.5, login fails with the below error:

U00045669 No matching EntityId '####' for *SP found in AudienceRestriction URIs in SAML response for destination xxx.xxx.xxx.xxx

This error occurs because version 24.4.5 introduced stricter validation of the Audience URI against the *SP EntityID configured in the UC_SAML_SETTINGS variable

Environment

• Automic Automation Engine 24.4.5 and higher
• Identity Provider (e.g., Microsoft EntraID/Azure AD)
• SAML/SSO Authentication

Cause

Starting with version 24.4.5, the Automation Engine performs an exact, case-sensitive string match between the *SP EntityID in UC_SAML_SETTINGS and the Identity Provider's SAML response. Subtle mismatches (e.g., trailing slashes, http vs https, or character case) that were silently ignored in older versions now cause validation to fail.

Resolution

1. Access the UC_SAML_SETTINGS variable in the Automation Engine.
2. Note the exact literal value configured for *SP.
3. Access your Identity Provider (e.g., EntraID Enterprise Application) SAML configuration.
4. Compare the "Identifier (Entity ID)" field character-for-character against the *SP value from step 2.
5. Verify the following common discrepancies:
   • Trailing slashes (present on one, missing on the other).
   • Protocol differences (http:// vs https://).
   • Upper/lower case differences.
   • Any leading or trailing whitespace.
6. Correct the value on the side that does not match and re-test the login.