Skip to Content (Press Enter)
How is your experience with the OutSystems Community?
UserImage.jpg
Na Fu
14Views
3Comments
Issue hit to enable dual authentication: Active Directory and Microsoft Extra
Question
Authentication

I have been following the official documentation (Configure Microsoft Entra authentication - OutSystems 11 Documentation) to configure Microsoft Entra authentication for my O11 Traditional Web App, without installing the IdP Forge component.

Here is what I have done and observed:

  1. I uploaded Federation metadata xml file.
  2. I downloaded both the SP Metadata XML file and the from_metadata.pem file from the configuration page. Both files are not empty.
  3. However, after saving the configuration, I checked the Config_File and Config_FileBinary tables in the database, and both tables are completely empty — no data was persisted.
  4. When I try to log in to the application, I get the error: 'UNABLE TO PROCESS REQUEST / Error processing SAML response.'

My goal is to enable both Internal Login and Microsoft Entra ID authentication simultaneously for my existing O11 Traditional Web App.

Could anyone please help me analyze:

  • What might be the root cause of this issue?
  • Any configuration steps I miss out?
  • What step-by-step troubleshooting actions should I take to resolve this and successfully enable dual authentication?

Thank you in advance for your assistance.

0
0
23 Jun
Copy Link
2026-01-28 16-57-48
Mihai Melencu
Champion

Hi @Na Fu ,

You can check the SAML Message Logs in the Users application. The link is available in the right sidebar. 

0
0
23 Jun
Copy Link
UserImage.jpg
Na Fu

Thank you, below is the SAML Message log, maybe I can proceed the investigation based on it.

0
0
23 Jun
Copy Link
2026-01-28 16-57-48
Mihai Melencu
Champion

 Replying to Na Fu's comment on 23 Jun 2026 07:36:53

Based on the documentation :

If the option Accept Only Signed Login Responses in the OutSystems Users application is active (it's enabled by default), make sure you activate the corresponding setting in your Identity Provider.The option Accept Only Signed Login Responses is available in 1. Service Provider Connector Settings, under Advanced Options.

Note: The Users app requires SAML assertions to be signed. Make sure you activate the assertion signing setting in your Identity Provider.

Microsoft documentation: Certificate signing options in a SAML token - Microsoft Entra ID | Microsoft Learn

0
0
23 Jun
Copy Link
Community GuidelinesBe kind and respectful, give credit to the original source of content, and search for duplicates before posting.