Otdfbt

We have an Azure App Service which uses internal database user authentication and I'm in the process of switching it to Azure AD SAML 2.0 authentication.

I'm pretty sure I have it connected correctly, but I might be missing something in the User field mapping...

When I go to the login page, it redirects me to our AzureAD tenancy sign-in where I input my creds, get the MFA SMS and then it attempts to return to the app and I am presented with:

Azure AD single sign on failed.

The App has a form of logging in the SQL DB and when I look at the last entry, the details are:

Loading SAML Response
LOGIN STATUS
Login Status urn:oasis:names:tc:SAML:2.0:status:Success
ASSERTION NODE
CONDITIONS
TIME RANGE CHECK
NotBefore: 2019-05-28T05:46:49.6740000Z
Now: 2019-05-28T05:51:49.8790022Z
NotOnOrAfter: 2019-05-28T06:46:49.6740000Z
Time Range OK
ISSUER
Issuer OK
SIGNATURE VALIDATION
Checking response node for signature. + (samlp:Response/ds:Signature)
Response signature not found
Checking Assertion node for signature. (ds:Signature)
Signature found
CERTIFICATE LOAD
Certificate loaded "CN=accounts.accesscontrol.windows.net"
SIGNATURE CHECK
Signature check OK
USER SYNC
Attribute Names: http://schemas.microsoft.com/identity/claims/tenantid, http://schemas.microsoft.com/identity/claims/objectidentifier, http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name, http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname, http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname, http://schemas.microsoft.com/identity/claims/displayname, http://schemas.microsoft.com/ws/2008/06/identity/claims/groups, http://schemas.microsoft.com/identity/claims/identityprovider, http://schemas.microsoft.com/claims/authnmethodsreferences
USERNAME
Get username from mapping
Field Mapping - USERNAME to http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress (saml:AttributeStatement/saml:Attribute[@Name='http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress']).
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress not found
EXCEPTION
Username not found
 at AzureADSamlExtension.AzureAdSamlIdentity.<SamlAuthenticate>d__13.MoveNext()

If I remove the "schema" url's within the App's SAML profile field mapping settings so they are all empty and then retry, the different response I get is:

USER SYNC
USERNAME
Get SAML default Username (saml:Subject/saml:NameID)
EXCEPTION
No User Match
 at AzureADSamlExtension.AzureAdSamlIdentity.<SamlAuthenticate>d__13.MoveNext()

I'm waiting on the App developers to get back to me with support, but whilst trying to troubleshoot it myself, I'd like to know what I might be able to try to get it working.

The main field to start with is obviously going to be the User Name which is just our user's O365 email address... For what it's worth, I've already tried "mail", "userPrincipalName" and "User name"; they all result in a similar Field Mapping - USERNAME to *xyz* error.

Any suggestions?