https://descope.com logo
Join Slack
Powered by
hey team - facing an issue where a user cant login...
# ask-a-descoper
a
hey team - facing an issue where a user cant login and the audit logs error message isnt helpful. just mentions code "error_message": "[E013009]", which maps to "connector not found" - this is for a SAML SSO user. in the ui for them just says "authentication failed" projectid P2Wu6pWyXI8chIo1Z732c2hmsdbM userid U3A4m0imodMXRRgWq4DXMghc71iD
✅ 1
d
Hi, I'm Descope's AI assistant. I've put together an initial response below based on your question. A member of the support team will take over and follow up shortly. Issue Summary The user is experiencing login issues with SAML SSO, receiving an unhelpful error message in the audit logs: "[E013009]", which indicates that the connector is not found. In the UI, the error is displayed as "authentication failed". Project Information • Project ID: P2Wu6pWyXI8chIo1Z732c2hmsdbM • User ID: U3A4m0imodMXRRgWq4DXMghc71iDand Next Steps Please verify the following: • Ensure that the SAML connector is correctly configured in your Descope project. • Check if the user is assigned to the correct SAML identity provider. • Confirm that the SAML metadata is up to date and matches the configuration in your application. If the issue persists after these checks, I recommend escalating this matter to the support team for further investigation. Escalation I'm connecting you with a member of the Descope support team now.
g
Looks like JIT is disabled and this user is not there
a
this tenant is on SCIM and i see them in the user table so that means they exist? or are u saying they have been tombstoned ?
says active
g
Oh that's another user wait let me find it
when was the last time the user tried? I see the error at 9am PT
but not sync then
a
oh ur saying issue was they logged in before the record existed?
can u see when the record was created
hello?
wait i see they were created feb 23rd so thats def not it
g
Yes. I can see that. I'm still trying to figure out on the logs. Not sure why you get "user does not exist" on the user...
a
ok lmk ty
g
@Aparimeya Taneja - can you share the last time this user tried to login?
I do see other email trying to log in, but email is 
rha****@buc****.com
which looks suspiciously like that user. Any chance the mapping of the SSO returns a diff email?
a
i can ask but wont ur logs show last time they tried to log in ?
g
Mar 31, 9am PT
a
Copy code
<Attribute xmlns="urn:oasis:names:tc:SAML:2.0:assertion" FriendlyName="" Name="email" NameFormat="">
        <AttributeValue xmlns="urn:oasis:names:tc:SAML:2.0:assertion" xsi:type="">rharris@buckner.com</AttributeValue>
      </Attribute>
ok so same as the email field but diff than login id
does this mean that this person's email was chagned in their microsoft entra?
but with scim wouldnt this get updated on the next sync?
g
I'm not sure how Entra pushes email changes like this... @Doron Sharon any idea?
d
You need to look at the NameID and not the email. In Entra it might takes 40 minutes until getting an update.
a
still not propagated - does this mean their auto sync has stopped running or descope isnt ipdating the loginId?
d
We do what the IdP tells us to do, the IdP should send a scim event to replace the userName (that's the scim attribute corresponding to NameID in JIT)
Make sure you have JIT disabled as well.
a
i do have jit disabled. is there a way i can see idp logs ? i only see 2 logs when i serach for the user by email
@Bryce DesBrisay
b
ok so they confirmed their auto sync is still up and running, but it is still not updating the nameID <> email to match. would it make sense to delete records in descope & let their auto sync add new records for them (in 40 minutes when it runs again)? or something else? (also wondering if the IdP logs would be good to look at here & where to find them)
d
What is the tenant id?
b
T30vN3ItMliQcSOgAvvnP4KoFEbc
d
Checking
ok, for that user I see the following SCIM events (patch requests): 2 requests: First one - March 23 32755 PM UTC • Attribute: 
Director of Client Services
, Value: 
false
• Attribute: 
emails[type eq "work"].value
, Value: 
<mailto:rharris@buckner.com|rharris@buckner.com>
• Attribute: 
name.formatted
, Value: 
Rayne Harris
• Attribute: 
addresses[type eq "work"].formatted
, Value: 
Ogd**
• Attribute: 
addresses[type eq "work"].streetAddress
, Value: 
2***ton Blvd, Ste 2**
• Attribute: 
addresses[type eq "work"].locality
, Value: 
O***n
• Attribute: 
addresses[type eq "work"].region
, Value: 
U**h
• Attribute: 
addresses[type eq "work"].postalCode
, Value: 
8***1
• Attribute: 
addresses[type eq "work"].country
, Value: 
United States
• Attribute: 
phoneNumbers[type eq "work"].value
, Value: 
80***24 ext 4*4
• Attribute: 
phoneNumbers[type eq "fax"].value
, Value: 
80****1
• Attribute: 
externalId
, Value: 
Rayne
• Attribute: 
urn:ietf:params:scim:schemas:extension:enterprise:2.0:User:employeeNumber
, Value: 
HARRA1
• Attribute: 
urn:ietf:params:scim:schemas:extension:enterprise:2.0:User:department
, Value: 
Select Lines
Second one - March 23 33002 PM UTC • Attribute: 
urn:ietf:params:scim:schemas:extension:enterprise:2.0:User:manager
, Value: 
U3BLsYm7nOZJ1TO5Y8g2jbUp5UYq
b
So they did update their "work" email at some point, but not the actual NameID, right? So should we tell them to update the NameID to match the new email?
d
I want to see the actual login failure first
Can you share in what time did that user faced the login error?
b
I dont have exact timestamps, but the customer's email timestamps are from: 30 Mar, 07:02am (PST) for Rayne@ / rharris@ 31 Mar 2026, 09:22 (PST) for Saundra@ / shardy@ So sometime in that period should be shardy@ login attempt I can ask them to try again and record exact time, but this is all I have now
d
wait, chekcing
And if you can send me the SAML Response of that user it will be great. You can find it in the audits page, for the LoginSucceed event, Method: SSO (SAML).
If not I will try to see what I got in the logs
b
I only see LoginFailed logs
Copy code
{
  "browser": "Chrome",
  "correlation_id": "3BfdaDpOy6WDGD4ecdK6IsoEZNS",
  "device": "Desktop",
  "error_message": "[E013009]",
  "flow_execution_id": "3BfdZOUl9QJkzLejJRn1EyPzlYS",
  "flow_id": "sign-in-magic-link-social",
  "os": "Windows",
  "osVersion": "10.0",
  "request_details": {
    "contentLength": "6755",
    "headers": {
      "descope": {
        "cf-bot-score": "99",
        "cf-connecting-ip": "67.214.247.194",
        "cf-ja3-hash": "c2d6ee96a384947ed9ffab9aea3ecc5b",
        "cf-ja4": "t13d1510h2_8daaf6152771_560390466015",
        "cf-ray": "9e481b70b83e584c-IAD",
        "cf-threat-score": "0",
        "cf-verified-bot": "false",
        "sec-fetch-dest": "document",
        "x-asn": "13415",
        "x-request-id": "e76cdf5e1fe251739d49324289b8f977"
      },
      "http": {
        "origin": "<https://login.microsoftonline.com>",
        "referer": "<https://login.microsoftonline.com/>",
        "sec-fetch-dest": "document",
        "user-agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36"
      }
    },
    "host": "<http://auth.app.withfulcrum.com|auth.app.withfulcrum.com>",
    "method": "POST",
    "uri": "/v1/auth/saml/acs?projectId=P2Wu6pWyXI8chIo1Z732c2hmsdbM&tenantId=T30vN3ItMliQcSOgAvvnP4KoFEbc",
    "url": "/v1/auth/saml/acs?projectId=P2Wu6pWyXI8chIo1Z732c2hmsdbM&tenantId=T30vN3ItMliQcSOgAvvnP4KoFEbc"
  }
}
IdP SAML res
Copy code
<Response xmlns="urn:oasis:names:tc:SAML:2.0:protocol" ID="_354131d5-3288-4702-b77d-5d06294751c5" InResponseTo="_78279331-ba97-4216-a97d-da1af7b97ba3" Destination="<https://auth.app.withfulcrum.com/v1/auth/saml/acs?projectId=P2Wu6pWyXI8chIo1Z732c2hmsdbM&tenantId=T30vN3ItMliQcSOgAvvnP4KoFEbc>" Version="2.0" IssueInstant="2026-03-30T15:21:59.047Z">
  <Status xmlns="urn:oasis:names:tc:SAML:2.0:protocol">
    <StatusCode xmlns="urn:oasis:names:tc:SAML:2.0:protocol" Value="urn:oasis:names:tc:SAML:2.0:status:Success"></StatusCode>
  </Status>
  <Issuer xmlns="urn:oasis:names:tc:SAML:2.0:assertion"><https://sts.windows.net/c829d407-c897-4de8-870b-95090e09e5fe/></Issuer>
  <Assertion xmlns="urn:oasis:names:tc:SAML:2.0:assertion" Version="2.0" ID="_f8a9eb1f-3e06-4213-8dc6-295861a72200" IssueInstant="2026-03-30T15:21:59.044Z">
    <Issuer xmlns="urn:oasis:names:tc:SAML:2.0:assertion"><https://sts.windows.net/c829d407-c897-4de8-870b-95090e09e5fe/></Issuer>
    <Subject xmlns="urn:oasis:names:tc:SAML:2.0:assertion">
      <NameID xmlns="urn:oasis:names:tc:SAML:2.0:assertion">saundra@buckner.com</NameID>
      <SubjectConfirmation xmlns="urn:oasis:names:tc:SAML:2.0:assertion" Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
        <SubjectConfirmationData xmlns="urn:oasis:names:tc:SAML:2.0:assertion" NotOnOrAfter="2026-03-30T16:21:58.909Z" Recipient="<https://auth.app.withfulcrum.com/v1/auth/saml/acs?projectId=P2Wu6pWyXI8chIo1Z732c2hmsdbM&tenantId=T30vN3ItMliQcSOgAvvnP4KoFEbc>" InResponseTo="_78279331-ba97-4216-a97d-da1af7b97ba3"></SubjectConfirmationData>
      </SubjectConfirmation>
    </Subject>
    <Conditions xmlns="urn:oasis:names:tc:SAML:2.0:assertion" NotBefore="2026-03-30T15:16:58.909Z" NotOnOrAfter="2026-03-30T16:21:58.909Z">
      <AudienceRestriction xmlns="urn:oasis:names:tc:SAML:2.0:assertion">
        <Audience xmlns="urn:oasis:names:tc:SAML:2.0:assertion">P2Wu6pWyXI8chIo1Z732c2hmsdbM-T30vN3ItMliQcSOgAvvnP4KoFEbc</Audience>
      </AudienceRestriction>
    </Conditions>
    <AttributeStatement xmlns="urn:oasis:names:tc:SAML:2.0:assertion">
      <Attribute xmlns="urn:oasis:names:tc:SAML:2.0:assertion" FriendlyName="" Name="<http://schemas.microsoft.com/identity/claims/tenantid>" NameFormat="">
        <AttributeValue xmlns="urn:oasis:names:tc:SAML:2.0:assertion" xsi:type="">c829d407-c897-4de8-870b-95090e09e5fe</AttributeValue>
      </Attribute>
      <Attribute xmlns="urn:oasis:names:tc:SAML:2.0:assertion" FriendlyName="" Name="<http://schemas.microsoft.com/identity/claims/objectidentifier>" NameFormat="">
        <AttributeValue xmlns="urn:oasis:names:tc:SAML:2.0:assertion" xsi:type="">32849f1b-e1f1-4af5-970e-180a6c1fe852</AttributeValue>
      </Attribute>
      <Attribute xmlns="urn:oasis:names:tc:SAML:2.0:assertion" FriendlyName="" Name="<http://schemas.microsoft.com/identity/claims/identityprovider>" NameFormat="">
        <AttributeValue xmlns="urn:oasis:names:tc:SAML:2.0:assertion" xsi:type=""><https://sts.windows.net/c829d407-c897-4de8-870b-95090e09e5fe/></AttributeValue>
      </Attribute>
      <Attribute xmlns="urn:oasis:names:tc:SAML:2.0:assertion" FriendlyName="" Name="<http://schemas.microsoft.com/claims/authnmethodsreferences>" NameFormat="">
        <AttributeValue xmlns="urn:oasis:names:tc:SAML:2.0:assertion" xsi:type=""><http://schemas.microsoft.com/ws/2008/06/identity/authenticationmethod/password></AttributeValue>
        <AttributeValue xmlns="urn:oasis:names:tc:SAML:2.0:assertion" xsi:type=""><http://schemas.microsoft.com/claims/multipleauthn></AttributeValue>
      </Attribute>
      <Attribute xmlns="urn:oasis:names:tc:SAML:2.0:assertion" FriendlyName="" Name="email" NameFormat="">
        <AttributeValue xmlns="urn:oasis:names:tc:SAML:2.0:assertion" xsi:type="">saundra@buckner.com</AttributeValue>
      </Attribute>
      <Attribute xmlns="urn:oasis:names:tc:SAML:2.0:assertion" FriendlyName="" Name="given_name" NameFormat="">
        <AttributeValue xmlns="urn:oasis:names:tc:SAML:2.0:assertion" xsi:type="">Saundra</AttributeValue>
      </Attribute>
      <Attribute xmlns="urn:oasis:names:tc:SAML:2.0:assertion" FriendlyName="" Name="family_name" NameFormat="">
        <AttributeValue xmlns="urn:oasis:names:tc:SAML:2.0:assertion" xsi:type="">Hardy</AttributeValue>
      </Attribute>
    </AttributeStatement>
    <AuthnStatement xmlns="urn:oasis:names:tc:SAML:2.0:assertion" SessionIndex="_f8a9eb1f-3e06-4213-8dc6-295861a72200" AuthnInstant="2026-03-26T17:39:53.272Z">
      <AuthnContext xmlns="urn:oasis:names:tc:SAML:2.0:assertion">
        <AuthnContextClassRef xmlns="urn:oasis:names:tc:SAML:2.0:assertion">urn:oasis:names:tc:SAML:2.0:ac:classes:Password</AuthnContextClassRef>
      </AuthnContext>
    </AuthnStatement>
  </Assertion>
</Response>
d
yes login failed sorry
b
this was the most recent one from March 30 08:21
d
ok, so the NameID is:
Copy code
<mailto:saundra@buckner.com|saundra@buckner.com>
Copy code
<NameID xmlns="urn:oasis:names:tc:SAML:2.0:assertion">saundra@buckner.com</NameID>
And the login id is: `rharris@buckner.com`(which is what we got from the scim create event from the IdP.
First we need to understand from them what is the correct value
b
oh sorry this is for different user, they have like 4 users facing this issue
d
so we can know what we want to ask them to change
oh ok
b
saundra <> shardy & rayne <> rharris
let me find the rharris one
d
ok
b
Copy code
<Response xmlns="urn:oasis:names:tc:SAML:2.0:protocol" ID="_0099900e-215e-4e85-84f0-a3829ff94d31" InResponseTo="_33fa58f7-26d7-4172-b507-c6c9ba07f3b6" Destination="<https://auth.app.withfulcrum.com/v1/auth/saml/acs?projectId=P2Wu6pWyXI8chIo1Z732c2hmsdbM&tenantId=T30vN3ItMliQcSOgAvvnP4KoFEbc>" Version="2.0" IssueInstant="2026-03-31T16:11:06.028Z">
  <Status xmlns="urn:oasis:names:tc:SAML:2.0:protocol">
    <StatusCode xmlns="urn:oasis:names:tc:SAML:2.0:protocol" Value="urn:oasis:names:tc:SAML:2.0:status:Success"></StatusCode>
  </Status>
  <Issuer xmlns="urn:oasis:names:tc:SAML:2.0:assertion"><https://sts.windows.net/c829d407-c897-4de8-870b-95090e09e5fe/></Issuer>
  <Assertion xmlns="urn:oasis:names:tc:SAML:2.0:assertion" Version="2.0" ID="_043d3ee2-72ac-442a-aea7-0c435ca75400" IssueInstant="2026-03-31T16:11:06.025Z">
    <Issuer xmlns="urn:oasis:names:tc:SAML:2.0:assertion"><https://sts.windows.net/c829d407-c897-4de8-870b-95090e09e5fe/></Issuer>
    <Subject xmlns="urn:oasis:names:tc:SAML:2.0:assertion">
      <NameID xmlns="urn:oasis:names:tc:SAML:2.0:assertion">rharris@buckner.com</NameID>
      <SubjectConfirmation xmlns="urn:oasis:names:tc:SAML:2.0:assertion" Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
        <SubjectConfirmationData xmlns="urn:oasis:names:tc:SAML:2.0:assertion" NotOnOrAfter="2026-03-31T17:11:05.931Z" Recipient="<https://auth.app.withfulcrum.com/v1/auth/saml/acs?projectId=P2Wu6pWyXI8chIo1Z732c2hmsdbM&tenantId=T30vN3ItMliQcSOgAvvnP4KoFEbc>" InResponseTo="_33fa58f7-26d7-4172-b507-c6c9ba07f3b6"></SubjectConfirmationData>
      </SubjectConfirmation>
    </Subject>
    <Conditions xmlns="urn:oasis:names:tc:SAML:2.0:assertion" NotBefore="2026-03-31T16:06:05.931Z" NotOnOrAfter="2026-03-31T17:11:05.931Z">
      <AudienceRestriction xmlns="urn:oasis:names:tc:SAML:2.0:assertion">
        <Audience xmlns="urn:oasis:names:tc:SAML:2.0:assertion">P2Wu6pWyXI8chIo1Z732c2hmsdbM-T30vN3ItMliQcSOgAvvnP4KoFEbc</Audience>
      </AudienceRestriction>
    </Conditions>
    <AttributeStatement xmlns="urn:oasis:names:tc:SAML:2.0:assertion">
      <Attribute xmlns="urn:oasis:names:tc:SAML:2.0:assertion" FriendlyName="" Name="<http://schemas.microsoft.com/identity/claims/tenantid>" NameFormat="">
        <AttributeValue xmlns="urn:oasis:names:tc:SAML:2.0:assertion" xsi:type="">c829d407-c897-4de8-870b-95090e09e5fe</AttributeValue>
      </Attribute>
      <Attribute xmlns="urn:oasis:names:tc:SAML:2.0:assertion" FriendlyName="" Name="<http://schemas.microsoft.com/identity/claims/objectidentifier>" NameFormat="">
        <AttributeValue xmlns="urn:oasis:names:tc:SAML:2.0:assertion" xsi:type="">ae3635ae-1e90-40b1-8079-064021e7a3dd</AttributeValue>
      </Attribute>
      <Attribute xmlns="urn:oasis:names:tc:SAML:2.0:assertion" FriendlyName="" Name="<http://schemas.microsoft.com/identity/claims/identityprovider>" NameFormat="">
        <AttributeValue xmlns="urn:oasis:names:tc:SAML:2.0:assertion" xsi:type=""><https://sts.windows.net/c829d407-c897-4de8-870b-95090e09e5fe/></AttributeValue>
      </Attribute>
      <Attribute xmlns="urn:oasis:names:tc:SAML:2.0:assertion" FriendlyName="" Name="<http://schemas.microsoft.com/claims/authnmethodsreferences>" NameFormat="">
        <AttributeValue xmlns="urn:oasis:names:tc:SAML:2.0:assertion" xsi:type=""><http://schemas.microsoft.com/ws/2008/06/identity/authenticationmethod/password></AttributeValue>
        <AttributeValue xmlns="urn:oasis:names:tc:SAML:2.0:assertion" xsi:type=""><http://schemas.microsoft.com/claims/multipleauthn></AttributeValue>
      </Attribute>
      <Attribute xmlns="urn:oasis:names:tc:SAML:2.0:assertion" FriendlyName="" Name="email" NameFormat="">
        <AttributeValue xmlns="urn:oasis:names:tc:SAML:2.0:assertion" xsi:type="">rharris@buckner.com</AttributeValue>
      </Attribute>
      <Attribute xmlns="urn:oasis:names:tc:SAML:2.0:assertion" FriendlyName="" Name="given_name" NameFormat="">
        <AttributeValue xmlns="urn:oasis:names:tc:SAML:2.0:assertion" xsi:type="">Rayne</AttributeValue>
      </Attribute>
      <Attribute xmlns="urn:oasis:names:tc:SAML:2.0:assertion" FriendlyName="" Name="family_name" NameFormat="">
        <AttributeValue xmlns="urn:oasis:names:tc:SAML:2.0:assertion" xsi:type="">Harris</AttributeValue>
      </Attribute>
    </AttributeStatement>
    <AuthnStatement xmlns="urn:oasis:names:tc:SAML:2.0:assertion" SessionIndex="_043d3ee2-72ac-442a-aea7-0c435ca75400" AuthnInstant="2026-03-26T18:58:37.64Z">
      <AuthnContext xmlns="urn:oasis:names:tc:SAML:2.0:assertion">
        <AuthnContextClassRef xmlns="urn:oasis:names:tc:SAML:2.0:assertion">urn:oasis:names:tc:SAML:2.0:ac:classes:Password</AuthnContextClassRef>
      </AuthnContext>
    </AuthnStatement>
  </Assertion>
</Response>
d
ok, right: so same thing
Copy code
<NameID xmlns="urn:oasis:names:tc:SAML:2.0:assertion">rharris@buckner.com</NameID>
Do you know what is the correct value?
or 
rayne
?
b
ok I think they want to use Saundra@ & Rayne@
d
I see, so for some reason the IdP sends us 
<mailto:rharris@buckner.com|rharris@buckner.com>
in the SAML Response Name ID.
So we obviously don’t allow them in..
So they don’t need to change the scim
b
well theyve tried both, but neither work
d
Do you see a saml response with 
rayne
?
<mailto:rayne@buckner.com|rayne@buckner.com>
- in the SAML Response NameID?
b
nothing comes up in the audit logs for that search
d
yeah, so it means that the IdP never sent 
<mailto:rayne@buckner.com|rayne@buckner.com>
as the NameID. So the SCIM thing is ok, they have the correct value there.
The only thing they need to check is why the IdP sends the wrong NameID (which is the user identifier)
What is their IdP?
Okta? Azure?
Looks like Azure Entra
b
Yeah I think so
d
ok, so the identifier is the UPN there
Need to check what is mapped in their IdP to be the UPN. Since in Entra there is a different mapping for SCIM and SSO.
So I guess they have some miss match with the mapping at the IdP side.
The SCIM mapped correctly and the SSO doesn’t.
b
this mapping?
d
Adding @Tal Kapitolnik our Entra expert to provide more guidance.
No
In the Identity Provider side
Entra
b
ah ok got it
d
By the way, in the SSO Setup Suite, there is guidance what exactly need to be mapped:
b
thank you, I will look into that & send to the customer. but what is weird is they have had it set up for a while and it is working perfectly fine for most of their users, not sure exactly why it isnt working for these users
d
Maybe these users has two different emails.
And SSO identifier is mapped to be one email and SCIM identifier mapped to be the other email.
And for the users that it work for them they have the same email in both.
t
Yeah, it can be mapped to different attributes, and if they are not the same so we will get different values (A lot of times the email is different from the UPN for example). They need to check that the 
userName
attribute is mapped to 
userPrincipalName
for provisioning, and also in SAML which is what @Doron Sharon sent. For SCIM It's under the enterprise app > 
Manage
> 
provisioning
> 
attribute mapping
> 
Provision Microsoft Entra ID Users
and check the 
userName
attribute
b
Thank you for your help, I have relayed this to the user
👍 1
ok so it looks like they do have the SCIM mapping set up correctly in Entra, this is what they sent over - does anything stand out to you? I also looked at the SSO setup suite and Iin the attribute mapping tab I dont see an option for user.userPrincipalName in the dropdown (the page also looks very different than the screenshot you sent)
Not sure what the next steps are to debug/diagnose - would it work to delete those descope user records & wait for their auto sync to add them back?
d
Yes the scim is correct, that's we knew. Need to check for the SSO mapping in Entra.
Not the scim, which is where they send the wrong email.
And not it won't work to delete, since their Entra IdP still sends the wrong email upon SSO login. They need to check the SSO mapping.
This one
But not in the SSO setup suite / Descope side, they need to check that in the Entra side.
b
ah ok makes sense, I'll check with them about the SSO setup in Entra
ok this is what they sent back - looks like UUID is mapped to user.mail. So should I tell them to update the UUID/Name ID to map to the user.userPrincipalName instead?
t
Exactly
2 Views
Open in Slack
PreviousNext
Powered by