User Profile setting issues

You may encounter the following issues when you use SAMLv2 authentication.

1. Issue: In BMC Atrium Single Sign-On when you configure SAMLv2 with the persistent nameID support and configure the realm with User Profile set as Required or Ignored, and the Auto Federation is enabled, the following error is displayed in the browser when the IdP returns an assertion specifying the persistent nameID.
   
   You do not have a User Profile in this server for storing your persistent SAMlv2 data.
   
   Resolution: To resolve this issue, use the following steps:

1. 1. BMC recommends to use transient as SAMLv2 nameID and allows the BMC Atrium Single Sign-On to not persist the federation of the user account beyond the users active session.

   2. Disable the Auto Federation with persistent nameID.
      The BMC Atrium Single Sign-On requires the user to login to the realm after the user connects to the server for the first time to establish the account federation.

      Note

      This feature is used for restricting the set of users that are allowed to access the system based on the user accounts defined within the BMC Atrium Single Sign-On server.

   3. Change the User Profile to Dynamic. The BMC Atrium Single Sign-On creates a User Profile as needed, for storing the persistent SAMLv2 data.
      
      
2. Issue: The following error is displayed when User Profile is set to Required and Auto Federation is enabled.
   
   You do not have a required User Profile in this server. Please contact your Atrium SSO administrator.
   
   Resolution: To resolve this issue, use the following steps:

1. 1. When you use transient nameID, change the User Profile to Ignored.
   2. When you use persistent as nameID, change the User Profile to Dynamic.
   3. Disable the Auto Federation.
      The BMC Atrium Single Sign-On requires the user to login to the realm after the user connects to the server for the first time to establish the account federation.