User permission sync fails after SAML SSO integration in quote configuration

CRM Adobe Experience Cloud
, , , , , , , ,
1

We recently integrated SAML SSO with our Experience Platform Identity Service for quote configuration users. The SSO authentication works fine, but user permissions aren’t syncing correctly from our IdP to Adobe Experience Cloud.

Users can log in successfully, but they’re missing critical quote approval permissions. I’ve verified the SAML attribute mapping in our IdP configuration:

<Attribute Name="role">
  <AttributeValue>quote_approver</AttributeValue>
</Attribute>

The role attribute is being sent, but it’s not propagating to the user’s Experience Cloud profile. This is blocking our entire quoting workflow since approvers can’t access pending quotes. Has anyone dealt with IdP role propagation issues in the Identity Service configuration?

system 2

Here’s the complete solution based on your situation:

1. Fix SAML Attribute Mapping: Update your IdP configuration to use the ‘groups’ attribute instead of ‘role’. Your SAML assertion should look like this:

<Attribute Name="groups">
  <AttributeValue>quote_approver</AttributeValue>
  <AttributeValue>quote_editor</AttributeValue>
</Attribute>

2. Verify Identity Service Configuration: In Adobe Experience Cloud Admin Console:

  • Navigate to Settings > Identity > SAML SSO configuration
  • Confirm the attribute mapping shows ‘groups’ as the expected attribute
  • Verify your IdP certificate is valid and properly uploaded
  • Check that the Entity ID and ACS URL match your IdP configuration exactly

3. Align Permission Group Names: The AttributeValue must exactly match the permission group names in Experience Cloud:

  • Go to Admin Console > User Groups
  • List all permission groups for quote configuration
  • Ensure your IdP sends the exact same names (case-sensitive)
  • Common groups: ‘quote_approver’, ‘quote_editor’, ‘quote_admin’

4. Configure IdP Role Propagation: If you’re using dynamic group membership in your IdP:

  • Set up automated group assignment rules based on user attributes
  • Ensure the rules trigger before the SAML assertion is generated
  • Test with a dedicated test user account first

5. Experience Platform Identity Service Settings: In the Identity Service configuration:

  • Enable ‘Automatic User Provisioning’ to create user profiles on first login
  • Set ‘Permission Sync Frequency’ to ‘Real-time’ instead of ‘Scheduled’
  • Enable ‘Override Local Permissions’ if you want IdP to be the source of truth

6. Handle Sync Timing:

  • After configuration changes, wait 15-20 minutes for propagation
  • Force users to log out and clear browser cache
  • On fresh login, the new SAML assertion will be processed
  • Verify in Admin Console > Users that the permission groups appear

7. Troubleshooting Steps: If permissions still don’t sync:

  • Enable SAML assertion logging in Admin Console (Settings > Identity > Debug Mode)
  • Review the SAML response XML to confirm attributes are being sent
  • Check for any custom permission policies in quote-configure-price module that might override SSO permissions
  • Verify no conflicting manual role assignments exist for test users

8. Validation: Test with a dedicated user account:

  • Assign specific groups in your IdP
  • Perform SSO login
  • Check Admin Console to confirm groups appear under user profile
  • Verify the user can access quote approval workflows
  • Test with different permission combinations

The key issue in your case is the attribute name mismatch (‘role’ vs ‘groups’). Once you standardize on ‘groups’ and ensure exact name matching between IdP and Experience Cloud permission groups, the sync should work reliably. The Identity Service configuration needs to have ‘Automatic User Provisioning’ enabled to process the SAML attributes and create the appropriate permission assignments in real-time.

This draft is based on general Adobe Experience Cloud knowledge. It has not been verified against your specific version and environment. Practitioners: verify the steps and share your experience below.

3

I’ve seen this before. The SAML attribute name in your IdP needs to match exactly what Experience Cloud expects. Check your Identity Service configuration in the Admin Console - there’s a specific attribute mapping section where you define which SAML attributes map to which Experience Cloud permission groups. The default attribute name is usually ‘groups’ not ‘role’. Your IdP might be sending the right data but Experience Cloud isn’t recognizing it.

appsmithk 4

“Confirmed this resolves the permission sync issue — updating the IdP SAML assertion from ‘role’ to ‘groups’ attribute immediately restored quote_approver access in Adobe Admin Console.”

5

Are you using custom permission groups in quote configuration? I had a similar issue where the SAML assertion was correct but the permission group names in our IdP didn’t match the group names in Adobe Experience Cloud. You need to ensure the AttributeValue exactly matches the permission group name in the Admin Console, including case sensitivity and any special characters.

6

Thanks for the suggestions. I checked the Admin Console and you’re right - the attribute mapping was set to ‘groups’ but our IdP is sending ‘role’. I also noticed our permission groups in Experience Cloud use underscores like ‘quote_approver’ but we have some inconsistency in naming. Should I change the IdP configuration to send ‘groups’ instead, or can I modify the Experience Cloud attribute mapping to accept ‘role’?

7

Either approach works, but I’d recommend standardizing on ‘groups’ since that’s the Adobe convention. Update your IdP SAML configuration to use the ‘groups’ attribute name. Also, make sure you’re sending the full permission group name as it appears in Experience Cloud. If you have multiple roles, send them as multiple AttributeValue elements within the same Attribute tag. The Identity Service will process all of them and assign the corresponding permissions. After making changes, force a logout and fresh login to ensure the new SAML assertion is processed.

8

Don’t forget about the Identity Service sync delay. Even with correct SAML attributes, there’s sometimes a propagation delay between the Identity Service receiving the assertion and the permissions being applied to the user profile in quote configuration. I’ve seen this take up to 15-20 minutes in some cases. Also verify that your IdP certificate is properly configured in the Admin Console - invalid certificates can cause silent failures where authentication succeeds but attribute processing fails.

9

I want to add one more thing - check if you have any custom permission policies in your quote configuration module that might be overriding the SAML-provided permissions. Sometimes organizations set up manual permission assignments that conflict with SSO-based provisioning, causing the IdP roles to be ignored even when they’re correctly mapped.