Trouble with Azure AD SSO to F5 SP- Issue with 150…

We’re hitting the limit here,
we haven’t resolved it yet, but this might be at least more info for anyone else coming across the issue…

Update via Splunk support:

The issue is an Enhancement Request : SPL-159073 is that if an Azure SSO user is a member of more than 150 groups a link is sent rather than the group details, and at present Splunk doesn’t handle that link. We also encountered some cases where there are more than 100 groups, not 150 as indicated.

There’s also a (draft as at time of support ticket) Splunk knowledge article support provided (reproduced with permission):

Title – Splunk – Azure SAML/SSO authentication error “saml response does not contain group information”

Summary – Instructions on how to avoid receiving the error “saml response does not contain group information” when connecting to Splunk with SAML via Azure configured.

Description: To ensure that the token size doesn’t exceed HTTP header size limits, Azure AD limits the number of objectIds that it includes in a groups claim. If a user is member of more groups than the overage limit (150 for SAML tokens, 200 for JWT tokens), then Azure AD does not emit the groups claim in the token. Instead, it includes an overage claim in the token that indicates to the application to query the Graph API to retrieve the user’s group membership.

How to Identify:
– Splunk is configured for SAML authentication with Azure AD as the Identity Provider
– You attempt to login to Splunk with an Azure AD user which is a member of a SAML group configured in Splunk, and a member of more than 150 Azure AD groups in total (including nested groups).
– You receive the error “saml response does not contain group information” when logging in to Splunk.

Investigation: Enhancement Requests: SPL-134770 SPL-159073

Resolution:

Option 1: Reduce the overall group membership for each connecting Azure AD user to less than 150.

Option 2: Use Azure Application Roles instead of Azure AD Groups for authorization: