Skip to main content

SSO Login Fails with "Email Not Received" - Missing SAML Email Attribute in IdP

SSO login fails with a "we did not receive your email" error because the identity provider's SAML assertion is missing the email attribute - fixed entirely on the IdP side.

Issue

  • A user reports that SSO login fails on a tenant with an error screen indicating that the user's email address was not received.

  • This typically arises on a newly configured (or newly SSO-enabled) tenant shortly after identity-provider (IdP) SSO setup is confirmed.

  • The signing certificate and SAML metadata match a known-working environment, so the configuration appears correct at first glance.

  • Product area: Authentication & Authorisation (SAML SSO).

Key Points

  • The SAML assertion is reaching the platform and validating correctly against the signing certificate — the certificate and metadata are not the problem.

  • The failure is that the IdP's SAML assertion does not include the user's email address, so the platform cannot identify who is signing in. This produces the "email not received" screen.

  • SAML Attribute Statements are not published in SAML metadata. Comparing metadata files or certificates between a broken and a working tenant will not reveal a missing email attribute — this is why the issue is easily misdiagnosed as a certificate or metadata problem.

  • The fix is entirely IdP-side. No Fen-X platform-side change is required.

Resolution

Add the email attribute to the SAML Attribute Statement on the IdP application used for the affected tenant:

  1. In the IdP (e.g. Okta), open the service-provider application for the affected tenant.

  2. Add a SAML Attribute Statement:

    • Name: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress

    • Name format: Basic

    • Value: user.email

  3. Quickest route: copy the Attribute Statements from a working tenant's application (e.g. an environment that already logs in successfully) — it already sends the email attribute correctly.

  4. Retry SSO login. No platform-side change is needed.

Troubleshooting

Steps that precede confirming the root cause (they will not by themselves surface a missing attribute):

  • Confirm the affected tenant's signing certificate is valid and current.

  • Generate the affected tenant's SAML metadata XML and compare it against the working environment.

  • Obtain the signing certificate to confirm assertions validate — if they validate but login still fails with the email error, the cause is a missing email Attribute Statement, not the certificate or metadata.

Verification

  • After the IdP team adds the email Attribute Statement, the user retries SSO login and signs in successfully.

Did this answer your question?