--- title: Troubleshooting Guide for Setting up Access Server with SAML Authentication canonical: https://openvpn.net/as-docs/saml-troubleshooting/ product: Access Server Docs description: Troubleshoot common SAML authentication issues on Access Server. --- # Troubleshooting Guide for Setting up Access Server with SAML Authentication Access Server 2.11.0 and newer supports [SAML authentication](https://openvpn.net/as-docs/saml.md), allowing users to authenticate through an external Identity Provider (IdP). Here’s a guide to help troubleshoot common SAML authentication issues on Access Server. If needed, you can open a [support ticket](https://support.openvpn.com/) for additional assistance. ## Troubleshooting common SAML errors The following are common SAML error messages with causes and solutions provided. ### Random characters or incorrect username when using Entra ID (Azure) **Cause:** When the **NameID Format** isn't configured on the Azure IdP side, Azure sends randomly generated strings as SAML usernames. **Solution:** Refer to this support article: [Random Characters of Incorrect Username When Using Entra ID (Azure)](https://support.openvpn.com/hc/en-us/articles/31237411085339-Access-Server-Random-Characters-or-Incorrect-Username-When-Using-Entra-ID-Azure-for-SAML). ### This account is not set up to use SAML, use regular (non-SAML) authentication method **Cause:** SAML authentication isn't assigned correctly to the user or isn't enabled as the global authentication method. **Solution:** Verify that [SAML authentication is configured](https://openvpn.net/as-docs/saml.md) as the default method or enabled for the user. Additionally, ensure that the user is associated with the SAML app in your IdP. ### SAML authentication failed — RelayState is missing **Cause:** The **RelayState** parameter isn't set correctly in the SAML configuration with the idP. **Solution:** For users signing in via the Client Web UI, set **RelayState** to `cws`; for profile downloads, set it to `profile`. Also, check that the user is linked to the SAML app and associated groups on the IdP side. > **Tip** > > Enable the **[SAML Debug Flag](https://openvpn.net/as-docs/tutorials/tutorial--debug-flags/#step-2--select-the-needed-debug-flag)** in Access Server for detailed logging to identify the exact cause in server logs. ### Invalid redirect URI **Cause:** The `role_list` is incorrectly set in the **Assigned Default Client Scopes** in [Keycloak](https://openvpn.net/as-docs/tutorials/saml-keycloak.md). **Solution:** Remove `role-list` from **Assigned Default Client Scopes** for the SAML client app in Keycloak. ### Assertion validation failed **Cause:** SAML assertion validation failed, which can occur due to incorrect URLs or invalid certificates. **Solution:** - Verify that you accurately entered the IdP and SP URLs. To avoid errors, we recommend copying the URLs from Access Server as the Service Provider (SP) to the Identity Provider (IdP). - Import the correct Metadata XML file from the IDP to Access Server. Importing the XML file can minimize human errors. - Check that the IdP certificate used by the SP is correct and current. > **Tip** > > Enable the **[SAML Debug Flag](https://openvpn.net/as-docs/tutorials/tutorial--debug-flags/#step-2--select-the-needed-debug-flag)** in Access Server for detailed logging to identify the exact cause in server logs. ### The IdP Metadata URL cannot be reached or returned data is invalid: Required IdP field 'x509cert' missing in SAML Metadata **Cause:** A configuration error with the Keycloak settings or missing fields in the IdP Metadata file. **Solution:** Verify that [Keycloak](https://openvpn.net/as-docs/tutorials/saml-keycloak.md) is correctly configured and that the IdP Metadata file includes the `x409cert` field. ### SAML app on the IDP side with certificate expired **Cause:** The certificate for the SAML app on the IdP is expired, causing authentication to fail. The certificate is included in the metadata XML file imported into the SP (Access Server). **Solution:** 1. Generate a new certificate for the SAML app on the IdP. 2. Download a fresh Metadata XML file and re-import it to the SP in Access Server. ### The IdP metadata file is in the incorrect format **Cause:** The metadata file from the IdP has invalid fields, incorrect values, or missing elements that the SP expects. **Solution:** Review the metadata file for missing or incorrect fields. Ensure all necessary fields are formatted correctly. ### AADSTS75011: Authentication method 'X509, MultiFactor' **Cause:** The **RequestedAuthnContext** in the SAML request is mismatched. This happens when a user has already authenticated with a different **AuthnContext** (authentication method) than the one being requested. **Solution:** Refer to the resolution in our support article. - [Access Server: AADSTS75011: Authentication method SAML Azure Error](https://support.openvpn.com/hc/en-us/articles/19682300520219-Access-Server-AADSTS75011-Authentication-method-SAML-Azure-Error) ### Mismatch between provided username 'UserA' and username provided by SAML Identity provider 'UserB' **Cause:** Username mismatch between Access Server and the IdP. **Solution:** Ensure that the username entered in Access Server matches exactly with the one on the IdP side, including case sensitivity. For more, refer to [Mismatch between provided username 'UserA' and username provided by SMAL Identity provider 'UserB'](https://support.openvpn.com/hc/en-us/articles/13419872930459-Access-Server-Mismatch-between-provided-username-UserA-and-username-provided-by-SAML-Identity-provider-UserB). ### SAML and server-locked profiles > **Tip** > > Server-locked profiles can be used with SAML but are not optimal. When using server-locked profiles with SAML: - Set the **Username** to the user's SAML username (e.g., `user@domain.com`). - Any value can be entered in the **Password** field, as it will be ignored (use "saml" or similar). The field can't be left empty. - If the SAML username in Access Server and the IdP do not match in capitalization, authentication will fail. ### DENY: user in deny list, account suspended, or access denied **Issue:** You encountered one of these error messages: - **DENY: user in deny list** - **user account suspended** - **User access denied** **Reason:** This error message occurs in one of two situations: 1. The **deny access** box is checked for the user in the **User Permissions** table. 2. The **Deny access to unlisted accounts by default** is set to **Yes**. The user authenticates with an external system (PAM, LDAP, RADIUS, or SAML) and doesn't exist in the **User Permissions** table or match the username in the external system. #### Resolution for deny access box 1. Sign in to the Admin Web UI. 2. Click **User Management \> User Permissions**. 3. Click **Deny Access** to uncheck the box for the username. 4. Select **Save Settings** and **Update Running Server**. #### Resolution for Deny access to unlisted accounts by default You can resolve the issue by adding the user to Access Server's user permissions table or by allowing Access Server to add users automatically by setting **Deny access to unlisted accounts by default** to **No**. Follow the steps below for your preferred option. ##### Add the user: 1. Sign in to the Admin Web UI. 2. Click **User Management \> User Permissions**. 3. Add the user to the **User Permissions** table if it doesn't exist. - Ensure the spelling and case match between Access Server and the external authentication server. 4. Select **Save Settings** and **Update Running Server**. ##### Allow Access Server to add users: ###### Via the Admin Web UI 1. Sign in to the Admin Web UI. 2. Click **Authentication \> Settings**. 3. Under **External User Registration**, set **Deny access to unlisted accounts by default** to **No**. 4. Select **Save Settings** and **Update Running Server**. ###### Via the command-line interface (CLI) 1. Connect to the console and get root privileges. 2. Switch to the scripts directory: ``` cd /usr/local/openvpn_as/scripts/ ``` 3. Run the blow command to change the value to "false" (Default) or "true": ``` ./sacli --user "__DEFAULT__" --key "def_deny" --value "false" UserPropPut ./sacli start ``` ### How to resolve "Found an Attribute element with duplicated Name" error if Keycloak is used as SAML IdP **Cause:** The error is caused by the presence of multiple SAML attributes with the same name in the response. This can happen when a user is assigned multiple roles or groups, and each role or group is included as a separate attribute in the SAML response. **Solution:** Refer to the resolution in our support article. - [How to resolve "Found an Attribute element with duplicated Name" error if Keycloak is used as SAML IdP](https://support.openvpn.com/hc/en-us/articles/32197891674779-How-to-resolve-Found-an-Attribute-element-with-duplicated-Name-error-if-Keycloak-is-used-as-SAML-IdP) ## Advanced Debugging If these steps do not resolve the issue, enable the [SAML Debug Flag](https://openvpn.net/as-docs/tutorials/tutorial--debug-flags/#step-2--select-the-needed-debug-flag) in Access Server to capture detailed logs for further analysis. You can then try authenticating with SAML and check the server logs to identify any specific errors. For advanced troubleshooting, consider opening a support ticket with OpenVPN Support. --- Prev: [LDAP](https://openvpn.net/as-docs/ldap-troubleshooting.md) Next: [RADIUS](https://openvpn.net/as-docs/radius-troubleshooting.md) Index: https://openvpn.net/as-docs/llms.txt