SAML Integration with AD Self Service Plus

[AnthonyJulien]

Hi everyone!

I hope everything is fine.

I'm trying to integrate Cisco Meraki with AD Self Service, so the users can login to Meraki directly from the AD Self Service.

I have run the tests, but I am getting the error: Assertion contains no username and no role.

I'm relatively new to this SAML thing, and don't know how to resolve it.

Any help would be greatly appreciated.

I can see the username in the XML file, but no role? How should I be adding all of these things?

[RWelch]

Configuring SAML Single Sign-on for Dashboard 

[RWelch]

Integrating Active Directory with Sign-On Splash Page For MR Access Points 

[sungod · Accepted solution]

Have you defined the role(s) you want in Dashboard?

Org->Aministrators, scroll down to SAML administrator roles, if not you need to add at least one role.

The role defines what access rights a matchng user will be given.

Then in your AD, any user that you want to be able to login needs that role in their settings.

I've not used ADSSP but I see there''s a guide for Dashboard...

https://www.manageengine.com/products/self-service-password/help/admin-guide/Application/sso/merakic...

...it says....

Please make sure in Cisco Meraki the role (Organization > Administrators) maps to the department attribute and the username maps to the mail attribute in Active Directory.

There are also several SAML guides in Meraki documentation, for instance...

https://documentation.meraki.com/General_Administration/Managing_Dashboard_Access/Configuring_SAML_S...

With Dashboard SAML a user must have one role.

[AnthonyJulien]

Hello!

Thank you so much for the help!

I did the steps exactly as you mentioned from the AD side, and the issue was resolved (although I got another error, it seems I cannot use the same email address for both regular signin and SAML signin).

So I created another user with an email address not in use yet in Meraki, and I was able to login as expected without any issues.

That was a quick reply as well, thank you!

[PhilipDAth]

ps. You can have your SAML provide pass anything for the username, such as sAMAccountName or displayName.  If you don't pass an email address you avoid this issue of existing accounts.