RUCKUS One (R1) — SAML SSO Admin Login Fails: Incorrect Group Claim Attribute Name Sent by IdP | Knowledge Base

RUCKUS One (R1) — SAML SSO Admin Login Fails: Incorrect Group Claim Attribute Name Sent by IdP

Summary

When configuring SAML SSO for RUCKUS One (R1) admin logon using a third-party IdP (e.g., Ping Identity backed by Microsoft Active Directory), group-to-role mapping may fail even when the correct group value is visible in the SAML assertion. The root cause is that the IdP is sending the group attribute under an incorrect attribute name (e.g., user.groups) instead of the name R1 expects: groups.

Question

Why are admin accounts not auto-creating in RUCKUS One after SAML SSO is configured, and why does group-to-role mapping not work even though the group value is present in the SAML assertion?

Customer Environment

R1 using Ping-Identity (or could be any other IdP) for admin logon using SAML

Symptoms

Admin accounts are not auto-created in R1 after SSO login.
Group-to-role mapping in R1 does not work — users can log in but are not assigned the expected admin role.
SAML tracer shows the correct group value is present in the assertion, but R1 does not recognize or act on it.

Root Cause

The IdP is configured to send the group claim under an incorrect attribute name (e.g., user.groups) instead of groups, which is the only attribute name recognized by RUCKUS One for group-to-role mapping.

Troubleshooting Steps

Captured a SAML trace - Used a browser SAML tracer extension to capture the assertion during an SSO login attempt and verified the group attribute is present in the assertion as shown in the screenshot below.
Verified Group-to-Role mapping in R1 - In R1, navigated to Administration > SSO Configuration > Group-to-Role Mapping and confirmed the group name entered in R1 exactly matches the group value sent in the SAML assertion and the correct admin role (e.g., Admin, Prime Admin) is mapped to that group -

Resolution

On the IdP (e.g., Ping Identity), updated the SAML attribute mapping so that the group claim is sent with the attribute name "groups" (not "user.groups", "member_of" or any other variant):

Once the attribute name was corrected, R1 recognized the group claim and applied the Group-to-Role mapping, and auto-assigned the appropriate admin role upon SSO login.

Article Number:
000015457

Updated:
August 03, 2026 05:24 AM (about 1 month ago)

Tags:
Troubleshooting, Configuration, Ruckus Cloud WiFi

Votes:
0

This article is:
helpful
not helpful