Forum Discussion

Olowndez's avatar
Olowndez
Icon for Nimbostratus rankNimbostratus
Dec 08, 2019

F5 APM as IdP for Office365 Error - The user account does not exist

Hello guys:

 

I hope you could help me with this question.

 

I am trying to deploy the F5 APM solution to allow users to access to Office 365 across a SAML object in a webtop. I managed to configure the user authentication by using local AD which synchronises with Azure AD. By using this guide https://www.australtech.net/wp-content/uploads/2016/11/microsoft-office-365-idp-dg.pdf, I configured the F5 APM to act as an Identity Provider (IdP) in the SAML environment. I also federated the url to which the users point to access the APM site by following the process located in page 12 of the previously mentioned guide. However, every time the users login into the APM and click in the SAML resource to try to reach Office 365, there is an error which says: "AADSTS51004: The user account jsmith@example.com does not exist in the d36f0dg9-r345-78h1-dff4-v678g7y87g6y directory. To sign into this application, the account must be added to the directory". I tested by modifying the assertion value to only jsmith but I did not succeeded. Do I need to make more changes in the AD and Azure AD servers to overcome this issue? I am not allowed to change all the users' profiles or other stuff.

 

Thanks a lot

 

Luis

2 Replies

  • Hello, I would go into the APM logging profiles and set the Access Policy logs to debug or informational and reproduce the issue to see what kind of errors are logged. The APM SAML logs are really good and pretty straight forward at identifying the issue.

  • Hi

     

    Something I encountered in the past is that you may need to login with UPN. Or UPN on your AD does not match the one in azure.

     

    Yoann