Problem activating SSO SAML with Azure EntraID on our self-hosted Business n8n instance

Questions
1

Hey everyone, we’re self hosting our n8n instance (Business Plan) on Azure and we’re having some trouble configuring SSO SAML

Describe the problem/error/question

We have tried setting up SSO SAML using Azure EntraID by following this guide: Set up SAML | Administer | n8n Docs and this guide: Set up Azure AD SAML | Administer | n8n Docs .
We have set up the claims as it was described in the guides.

image
image716×189 9.18 KB

What is the error message (if any)?

When clicking the “Test connection” button after configuring the SSO SAML on my n8n dashboard, I get redirected to a page showing an error and displaying this message :

“SAML Authentication failed. Invalid SAML response (missing attributes: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/firstname, http://schemas.xmlsoap.org/ws/2005/05/identity/claims/lastname).”

Information on your n8n setup

  • n8n version: 2.28.3
  • Database (default: SQLite): PostgresQL
  • n8n EXECUTIONS_PROCESS setting (default: own, main): main
  • Running n8n via (Docker, npm, n8n cloud, desktop app): Docker
  • Operating system: Linux
2

Hey! This is a classic Azure SAML claims mapping issue and n8n is expecting firstname and lastname attributes but they’re not coming through in the SAML response.

In your Azure Entra ID app, go to Single sign-on → Attributes & Claims and make sure these two are explicitly added:

  • http://schemas.xmlsoap.org/ws/2005/05/identity/claims/firstname → mapped to user.givenname
  • http://schemas.xmlsoap.org/ws/2005/05/identity/claims/lastname → mapped to user.surname

The default Azure claims setup often skips these or uses different attribute names, which is exactly what’s causing the mismatch.

After saving, test the connection again and it should go through. Let us know if you’re still seeing the error!

3

Hi @Vincent67 Welcome!
That error means the assertion is reaching n8n, but those two claims are arriving under a name other than the exact URI n8n expects. In Entra the emitted claim type is Namespace + Name, set in two separate boxes, so the full type only becomes http://schemas.xmlsoap.org/ws/2005/05/identity/claims/firstname when the claim is configured as:

Name: firstname
Namespace: http://schemas.xmlsoap.org/ws/2005/05/identity/claims

If the Namespace box is left empty, Entra emits the claim as plain firstname with no prefix, and n8n reports it as missing. Open each claim under Single sign-on > Attributes & Claims, set the Name and Namespace exactly as above (Name lastname for the other one), and save.
Separately, Entra drops any claim whose source attribute is empty, so make sure the test user has a First name and Last name filled in on their Entra profile, or those two claims won’t be sent at all.
To confirm what is actually arriving, read the assertion with the SAML Chrome Panel browser extension during Test connection.