Troubleshooting SSO Login Failures Due to Missing Roles Attribute in CloudHealth

Products

• CloudHealth

Issue/Introduction

Users are unable to log in to their CloudHealth account via SAML SSO. The login process fails with an error message stating that the user is not assigned to any role.

 

Cause

Check and make sure that The identity provider (IDP) is passing the required "roles" attribute in the SAML assertion.

CloudHealth requires this attribute to map the user to a specific CloudHealth role during the authentication process.

Resolution

To resolve this, configure your IDP to include the roles attribute in the SAML assertion. The value passed should correspond to the user's access level:

• cloudhealth-administrator: Maps to the Administrator role.
• cloudhealth-power: Maps to the Power User role.
• cloudhealth-standard: Maps to the Standard User role.

Example from an Assertion sent by IDP that includes the Roles attribute needed by CloudHealth

 </ns2:Attribute>
      <ns2:Attribute Name="roles" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified">
        <AttributeValue>cloudhealth-administrator</AttributeValue>
      </ns2:Attribute>
    </ns2:AttributeStatement>

Additional Information

Reference: For detailed configuration steps, please refer to the CloudHealth documentation for enabling SAML SSO for Classic Organizations.