Snowflake is giving me the error "SAML response is invalid or matching user is not found. Contact your local system administrator"

Question

I have an Azure Active directory with SSO and provisioning enabled. Users from my company can SSO into snowflake just fine, but when I invite a user from GMail or another domain into our AD they get the SAML error. The Snowflake AD app has provisioned the user to Snowflake correctly from what I can see.

How do I troubleshoot this?

Thanks, Phil

Answer 1

This error is due to unable to identify the user. Please specify the complete name if the user while authenticating:

snowsql -a mytest.us-east-1 -u xyz@abc.com

Answer 2

@suzy_lockwood It was the NameID attribute giving me the problem. I linked it back to the Snowflake Application in my Azure AD. The fix was to go to Manage > Single-Sign On > User Attributes and Claims. Under Required Claim I opened the claim "Unique User Identifier (Name ID) and changed the source attribute from UPN to be user.mail.