uid属性がないCisco DuoでSAML認証が失敗する
環境
- ONTAP System Manager 9.12.1以降
- Cisco Duo
問題
- ONTAP 9.12.1以降では、Cisco Duoがサポートされています。
- Cisco Duoを設定すると、System Managerの認証が次のエラーで失敗します。
The SAML service provider did not identify the user that was authenticated. Ensure that the SAML identity provider is configured to include in its assertion a"uid" attribute (SAML name "urn:oid:0.9.2342.19200300.100.1.1") whose value matches the service provider user name.
Authorization failed for the resource at "/sysmgr/v4/" - クラスタのapache-errorログには、次の情報が表示されます。
[Thu Jul 13 18:24:21.619555 2023 +0000] [dot:error] [pid 47409:tid 34410555392] [client 10.247.250.234:61560] The user authenticated through SAML or OIDC, but the service provider did not provide a user ID needed for authorization.
[Thu Jul 13 18:24:21.619569 2023 +0000] [authz_core:error] [pid 47409:tid 34410555392] [client 10.247.250.234:61560] AH01631: user : authorization failure for "/sysmgr/v4/"