Okta Cisco Meraki Dashboard SAML Login Fails Due to an Existing Non-SAML User
Last Updated:
Overview
A Cisco Meraki Dashboard Security Assertion Markup Language (SAML) login failure occurs when the username attribute matches an existing administrator or authentication user email address. Resolve this issue by removing the existing administrator user from the Cisco Meraki Dashboard, then log in via the SAML integration to recreate the account. An attempt to log into the Cisco Meraki Dashboard SAML integration results in a page that displays "true" and generates the following error in the Cisco SAML logs:
Found existing non-SAML user with email EmailAddress@domain.com
Applies To
- Okta Identity Engine (OIE)
- Okta Classic Engine
- Security Assertion Markup Language (SAML)
- Cisco Meraki Dashboard
Cause
According to Cisco Meraki documentation, the username attribute cannot match an existing Dashboard administrator or Meraki Authentication user email address configured on any Dashboard Organization. Converting an existing non-SAML Meraki administrator account to a SAML account requires deleting the account from the dashboard and re-adding it as a SAML account via the SAML platform.
Solution
How is the Cisco Meraki Dashboard SAML login failure resolved?
Remove the administrator user with the matching email address from the Cisco Meraki Dashboard, then log in via the SAML integration to recreate the user as a SAML account.
- Remove the administrator user with a matching email address from the Cisco Meraki Dashboard.
- Log in as that user via the SAML integration to recreate the user within the Cisco Meraki Dashboard as a SAML account.
NOTE: Assign the appropriate permissions to the role the user receives in the Cisco Meraki Dashboard before removing the user to ensure the account generates with the desired permissions. Retain at least one local administrator account to ensure an administrator maintains access if a SAML Single Sign-On (SSO) issue occurs.
