How you know whether the identity provider (IdP) returned the correct ZivverAccountKey value?

Cause

When you create a Zivver account with the Synctool, a user attribute is the basis of the ZivverAccountKey. In most cases, this is AD attribute ObjectGUID. When you setup a single sign-on (SSO) link, the IdP must fetch the same ZivverAccountKey value. Also, the SAML response to the service provider (SP) must contain that same value. If the ZivverAccountKey at creation does not agree with the value in the SAML response, the user cannot login directly. After the user entered the SSO credentials, they see “please enter your Zivver password once”.

Solution 1

Examine the SAML response. - Identify which ZivverAccountKey value the IdP sent to the SP. - Identify which authentication the SAML shows.

Solution 2

1. Open Chrome.
2. Install the SAML Message Decoder.
3. Go to https://app.zivver.com
4. Enter your mail address.
5. Wait for the WebApp to redirect you to the IdP.
   ADFS authenticates you with Windows Authentication.
   If not, manually enter your SSO credentials.
6. Wait until you see Please enter your Zivver password once.
   
7. Click on the SAML Decoder icon.
8. Go to the latest message.

9. Search for an XML snippet similar to this snippet.

   <saml:AttributeStatement> 
   <saml:Attribute Name="https://zivver.com/SAML/Attributes/ZivverAccountKey" NameFormat="urn:oasis:names:tc:SAML:2:attrname-format:basic"> 
   <saml:AttributeValue>482548ad-506d-47cc-842d-ea1042d0addf>
   </saml:AttributeValue> 
   </saml:Attribute>
   

Remarks

• You can see which value is set for ZivverAccountKey.
  482548ad-506d-47cc-842d-ea1042d0addf.
• You can do a check whether the value is correct.
  Use the Synctool > Step 2 > Preview users in Zivver. The password column shows the ZivverAccountKey.
• Do not compare the value with the value for ObjectGUID in the AD Attribute Editor for this specific user. The reason is that the Attribute Editor shows you a user friendly ObjectGUID. You must compare it with the Base64 value of ObjectGUID.