Search code examples
azure-active-directorysingle-sign-onsamlgoogle-workspace

Azure/Gsuite connector authentication issues, Server Error & Invalid Email

The problem: I'm getting errors from Google while attempting SSO through Azure AD and can't even begin to guess why or how to go about debugging the issue.

The story:

My org is looking at leveraging Microsoft's nonprofit benefits by setting up Azure for web hosting and Sharepoint to start with, which also entails using Active Directory. As it stands right now, we've successfully gotten our website running and accessible to the world on our custom domain, and our AD is populated with a copy of what's in our Google Workspace directory so we can use Active Directory as our authoritative directory.

We've been trying to implement SSO with the Azure/Gsuite connector, to have them auth with their Azure credentials to get into GMail, Docs, Drive, etc, but Google Workspace seems to choke. I have gone over the setup instructions repeatedly, ensured we're using all of the proper URLs in the Connector's SAML settings and in Workspace's "SSO with third party IDPs" settings, the proper certificate is in place... Provisioning is set up but not active, and I have successfully provision-on-demanded my account and an unprivileged test account.

Here are my settings in Azure:

Connector settings in Azure

Here are my settings in Google:

Third Party SSO settings in Google Admin

And to test this here's what I've done:

  1. I open up a fresh InPrivate/Incognito window.
  2. I go to https://myapplications.microsoft.com/ and am prompted to login. I use my unprivileged test account credentials.
  3. Upon auth I click on the Connector app to attempt to go to my Gmail inbox.
  4. After a wait on a white screen, I get a Google error screen with "Invalid Email - We are unable to process your request at this time, please try again later."

If I disable the SSO settings for my org in Google Admin, I'm able to log into the account just fine with Google, get to the gmail inbox, etc.

Conversely, if I attempt the same steps with my admin account, I get a similar page with a slightly different message, "Server Error - We are unable to process your request at this time, please try again later."

I have been bashing my head against this for two whole nights and can't make any headway. What gives? I can't even figure out how to debug these errors.

Solution

  • Somebody (me) failed their perception check repeatedly because the problem was that the Unique User Identifier SAML claim in Azure was set to user.mail instead of user.userprincipalname as it should have been as per the tutorial.

    I'll see myself out now.