# AD FS and SAML/ Account not provisioned

**URL:** <https://help.nextcloud.com/t/ad-fs-and-saml-account-not-provisioned/161885>\
**Category:** ℹ️ Support\
**Tags:** sso, nc25\
**Created:** [May 11, 2023, 3:56am UTC](https://help.nextcloud.com/t/ad-fs-and-saml-account-not-provisioned/161885 "2023-05-11T03:56:53Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Oleg\_Zhukov](https://help.nextcloud.com/user_avatar/help.nextcloud.com/oleg_zhukov/32/51275_2.png) [@Oleg\_Zhukov](https://help.nextcloud.com/u/Oleg_Zhukov)\
**Post date:** [May 11, 2023, 3:56am UTC](https://help.nextcloud.com/t/ad-fs-and-saml-account-not-provisioned/161885/1 "2023-05-11T03:56:53Z")

</div>

Nextcloud version **25.0.6  
Operating system and version: Ubuntu 22.04**  
nginx version : 1.18.0  
**PHP version : 8.1**

 

Is this the first time you’ve seen this error? _(Y)_:

Steps to replicate it:

1. Login using LDAPUser
2. Connects fine
3. Go into apps and enable User\_SAML
4. Connect to NextCloud and get forwarded to IDP for login
5. Login using same account
6. Get error: Account not provisioned. Your account is not provisioned, access to this service is thus not possible.

The output of your Nextcloud log in **Admin \> Logging** :

```auto
IDP parameter for the UID not found. Possible parameters are: []

```

SSO & SAML authentication not working using Microsoft AD FS 2022 iDP. LDAP authentication works correctly

Error when logging in Account not provisioned

In Chrome Developer Tools the following SAMLResponce data:

```auto
<samlp:Response ID="_5cb7817a-ee03-4190-b4e5-ac1e30cc35d1" Version="2.0" IssueInstant="2023-05-11T03:05:10.623Z" Destination="https://nextcloud/index.php/apps/user_saml/saml/acs" Consent="urn:oasis:names:tc:SAML:2.0:consent:unspecified" InResponseTo="ONELOGIN_ad6a24cdd9f93643a669696bb15791d1d705f8fb" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol">
<Issuer xmlns="urn:oasis:names:tc:SAML:2.0:assertion">http://ADFS/adfs/services/trust</Issuer>
<samlp:Status>
<samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/></samlp:Status>
<Assertion ID="_8540e7de-978b-42ba-95c3-ec477acca4c3" IssueInstant="2023-05-11T03:05:10.623Z" Version="2.0" xmlns="urn:oasis:names:tc:SAML:2.0:assertion">
<Issuer>http://ADFS/adfs/services/trust</Issuer>
<ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"><ds:SignedInfo>
<ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
<ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/>
<ds:Reference URI="#_8540e7de-978b-42ba-95c3-ec477acca4c3">
<ds:Transforms>
<ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
<ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></ds:Transforms>
<ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
<ds:DigestValue>EcuCsu6mbeXLd25n5DAmY6+gGsKuRJuxmqbnngeccL8=</ds:DigestValue>
</ds:Reference></ds:SignedInfo>
<ds:SignatureValue>rzqD...</ds:SignatureValue>
<KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">
<ds:X509Data><ds:X509Certificate>MIIE3..</ds:X509Certificate></ds:X509Data>
</KeyInfo></ds:Signature>
<Subject>
<NameID>my_sAMAccountName</NameID> - Correct
<SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
<SubjectConfirmationData InResponseTo="ONELOGIN_ad6a24cdd9f93643a669696bb15791d1d705f8fb" NotOnOrAfter="2023-05-11T03:10:10.623Z" Recipient="https://nextcloud/index.php/apps/user_saml/saml/acs"/>
</SubjectConfirmation></Subject>
<Conditions NotBefore="2023-05-11T03:05:09.998Z" NotOnOrAfter="2023-05-11T04:05:09.998Z">
<AudienceRestriction>
<Audience>https://nextcloud/index.php/apps/user_saml/saml/metadata</Audience>
</AudienceRestriction></Conditions>
<AuthnStatement AuthnInstant="2023-05-11T03:03:21.825Z" SessionIndex="_8540e7de-978b-42ba-95c3-ec477acca4c3">
<AuthnContext>
<AuthnContextClassRef>urn:federation:authentication:windows</AuthnContextClassRef>
</AuthnContext></AuthnStatement></Assertion></samlp:Response>

```

Settings iDP:

Name – Nextcloud  
Endpoint - [https://nextcloud-domain/index.php/apps/user\_saml/saml/acs](https://nextcloud-domain/index.php/apps/user_saml/saml/acs)

 ![1](https://help.nextcloud.com/uploads/default/original/3X/c/c/ccbba4995815fcb5de93ae3ed7ac7518736722df.png)

Settings LDAP  
Internal Username Attribute: sAMAccountName

Settings user\_saml

 ![4](https://help.nextcloud.com/uploads/default/original/3X/f/7/f755c964e6dd0c1ef86e89196768f7ed226a7e10.png)

Used many options for specifying attributes: userPrincipalName, UPN, NameIdentifier

---

<div class="post-metadata">

**Author:** ![abctaylor](https://help.nextcloud.com/letter_avatar/abctaylor/32/5_5575768a8748004e209b776fc1b2916d.png) [@abctaylor](https://help.nextcloud.com/u/abctaylor)\
**Post date:** [August 1, 2023, 7:24pm UTC](https://help.nextcloud.com/t/ad-fs-and-saml-account-not-provisioned/161885/2 "2023-08-01T19:24:13Z")

</div>

Did you ever get this to work?

---

<div class="post-metadata">

**Author:** ![nicovd737](https://help.nextcloud.com/letter_avatar/nicovd737/32/5_5575768a8748004e209b776fc1b2916d.png) [@nicovd737](https://help.nextcloud.com/u/nicovd737)\
**Post date:** [July 19, 2024, 6:16am UTC](https://help.nextcloud.com/t/ad-fs-and-saml-account-not-provisioned/161885/3 "2024-07-19T06:16:52Z")

</div>

Hello,

We have the exact same issue.  
If someone have an idea, will be welcome.  
SAML response is successful but nextcloud answer that user is not provisionned.  
The SAML debugger give us the same response as indicate in this subjet.  
Thanks

---

<div class="post-metadata">

**Author:** ![Angelo\_Pro](https://help.nextcloud.com/user_avatar/help.nextcloud.com/angelo_pro/32/55180_2.png) [@Angelo\_Pro](https://help.nextcloud.com/u/Angelo_Pro)\
**Post date:** [December 21, 2024, 1:51am UTC](https://help.nextcloud.com/t/ad-fs-and-saml-account-not-provisioned/161885/4 "2024-12-21T01:51:28Z")

</div>

I have the same issue in that moment of life, then…

In the rule instead of “Name ID” write sAMAccountName, put the raw reference of the LDAP attribute and done.

![image](https://help.nextcloud.com/uploads/default/original/3X/5/b/5b083d680ab244312a2812aa005edc1c59915d13.png)

and the setting in “user\_saml” is correct.

Check this guide with google translator: [Windows, SQL and other: Nextcloud SSO ADFS](https://os-zenia.blogspot.com/2021/01/nextcloud-sso-adfs.html)

Regards.

---

<div class="post-metadata">

**Author:** ![Paul\_Edwards](https://help.nextcloud.com/user_avatar/help.nextcloud.com/paul_edwards/32/69281_2.png) [@Paul\_Edwards](https://help.nextcloud.com/u/Paul_Edwards)\
**Post date:** [February 19, 2025, 2:15pm UTC](https://help.nextcloud.com/t/ad-fs-and-saml-account-not-provisioned/161885/5 "2025-02-19T14:15:38Z")

</div>

Do any of you have access to your M365 Entra? Creating an Enterprise application for Nextcloud within there will likely solve this for some of you.  
[https://medium.com/@ntrussell/enable-nextcloud-sso-authentication-through-microsoft-azure-active-directory-saml-abe37d735cd](https://medium.com/@ntrussell/enable-nextcloud-sso-authentication-through-microsoft-azure-active-directory-saml-abe37d735cd)

---

<div class="post-metadata">

**Author:** ![wwe](https://help.nextcloud.com/user_avatar/help.nextcloud.com/wwe/32/72963_2.png) [@wwe](https://help.nextcloud.com/u/wwe)\
**Post date:** [January 16, 2026, 8:30pm UTC](https://help.nextcloud.com/t/ad-fs-and-saml-account-not-provisioned/161885/6 "2026-01-16T20:30:53Z")

</div>