topic MISSING_EMAIL_IN_RESPONSE with SAML sign on in APIs & Integrations

MISSING_EMAIL_IN_RESPONSE with SAML sign on

ZPykosz — Tue, 29 Apr 2025 20:03:25 GMT

We've setup an Auth0 application to let users sign into HubSpot customer portal using SAML but suddenly we're seeing MISSING_EMAIL_IN_RESPONSE error in log in response and users cannot log in. I've reached out to Auth0 already and they suggest to find out what HubSpot wants for email attribute.

Did something change on HubSpot's side? If we need a mapping from Auth0 email attribute to HubSpot, what is the mapping field?

Re: MISSING_EMAIL_IN_RESPONSE with SAML sign on

BérangèreL — Wed, 30 Apr 2025 08:10:36 GMT

Hi @ZPykosz and welcome, it's a pleasure to have you here!

Thanks for reaching out to the HubSpot Community!

I checked for you and I can see on this article "Which username format should I set in my SAML application?" that HubSpot users are identified by email address. Ensure that your IDP is sending a nameID in email format that corresponds with their HubSpot user’s email address.

Also, I'd love to put you in touch with our Top Experts: Hi @Anton, @Phil_Vallender and @miljkovicmisa do you have suggestions to help @ZPykosz, please?

Have a lovely day and thanks so much in advance for your help!
Bérangère

Re: MISSING_EMAIL_IN_RESPONSE with SAML sign on

ZPykosz — Wed, 30 Apr 2025 13:13:50 GMT

I am seeing it send as ` <saml:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified">email@example.com</saml:NameID>`

is it the fact the format is unspecified?

Re: MISSING_EMAIL_IN_RESPONSE with SAML sign on

ZPykosz — Wed, 30 Apr 2025 14:07:22 GMT

I see that nameID is under 'subject' tag. Does it need to be under 'attributes' tag instead? I also see `nameidentifier` is often used as well. Which is it?

<saml:Subject> <saml:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified">email@example.com</saml:NameID> <saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"> <saml:SubjectConfirmationData NotOnOrAfter="2025-04-30T14:40:13.801Z" Recipient="https://manage.auth0.com/tester/samlp"/> </saml:SubjectConfirmation> </saml:Subject>

Re: MISSING_EMAIL_IN_RESPONSE with SAML sign on

ZPykosz — Wed, 30 Apr 2025 18:28:45 GMT

I can't tell how we lost this config but this seems to have fixed it.

In my Auth0 app for SAML, I needed to make sure the SAML2 addon was enabled and had this config

{
  "nameIdentifierProbes": [
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress"
  ]
}