AEM: New user unable to access Dev, QA, Stage due to federated identity truncation and username mismatch
In Adobe Experience Manager (AEM), you add a new user in the Admin Console, assign them to product profiles, and expect them to log in with single sign-on. Instead, that user can’t access AEM environments because the identity provider (IdP) is truncating or otherwise mismatching the username or email attributes. This keeps the user from authenticating with federated login. To fix this, align the identity attributes between your IdP and the Admin Console so the user can sign in successfully.
Description description
Environment
- Adobe Experience Manager (AEM)
- AEM Managed Services using Adobe IMS / Admin Console authentication
Issue/Symptoms
A new user created in the Admin Console is unable to access the Dev, QA, and Stage environments. The user appears in the Admin Console but cannot authenticate to AEM environments using federated login. Analysis of the authentication flow reveals a mismatch between the username/email sent in the federated authorize request and the value used in the federated token lookup, likely due to truncation of the username attribute by the identity provider.
Symptoms include:
- User is present in the Admin Console but cannot log in to AEM environments.
- Authentication flow reaches Adobe IMS/federated authentication, but fails during federated token resolution.
- The HAR file shows the full username (22 characters) is sent to the identity provider, but the response returns a truncated value (20 characters).
- The following error is returned by Adobe authentication services:
{"errorCode":"invalid_user",
"errorMessage":"Could not find account with username: [ truncated_username] and authSrcCode: [ authSrcCode] "}
- Only this user is affected; other users in the organization do not experience the issue.
Cause
The IdP truncates, remaps, or mismatches the username attribute, causing a failure in federated token resolution for user authentication in AEM.
Resolution resolution
-
Verify the user’s identity attributes in the identity provider (IdP):
- Check the IdP configuration for any character limits or truncation applied to the username or email attributes sent during SAML or federated authentication.
- Confirm that the attribute values (such as
NameIDor email) match exactly between the Admin Console and the IdP response.
-
Update the IdP configuration if necessary:
- If truncation is occurring, adjust the IdP settings to ensure the full username/email is sent to Adobe IMS without truncation.
- Coordinate with the IdP administrator to resolve any attribute mapping or length limitations.
-
Resync the user in the Admin Console:
- After correcting the IdP configuration, remove and re-add the user in the Admin Console if needed to ensure proper synchronization.
-
Test user authentication:
- Have the user attempt to log in again to the affected AEM environments.
- Confirm that the authentication flow completes successfully and the user can access the required environments.