SAML Error: "NameQualifier"

Last Updated: Feb 20, 2026

Overview

We are testing an inbound IDP-initiated SAML from our vendor and get: access_denied: NameQualifier attribute in the NameID element does not match https://shorew-test.redata.com/ms/SAML?MS_CONTEXT=SW_LEADINGRE_SAML . Please advise, this is an Enterprise SAML connection.

Applies To

SAML

Solution

After reviewing the associated connection in your staging tenant and based on the error message being returned, there are two paths we can take to resolve this issue which I will outline below.

Depending on the Identity Provider, it may be possible for your vendor to amend the NameQualifier in the SAML assertion to ensure it matches their EntityID. This would require change on their end, and may not be possible depending on their exact configuration.

Alternatively, I have found we do have an option that can be used to disable this validation for an individual connection. To do this, you need to use the Auth0 Management API to update the individual connection and set the "checkNameQualifier" parameter to false.

https://auth0.com/docs/api/management/v2#!/Connections/patch_connections_by_id

Below is an example of the body structure of such a request:

{
  "options": {
      ...place existing options here to ensure they are not overwritten
      checkNameQualifier: false
   }
}

By setting this property to false, the NameQualifier validation will be disabled for this individual connection, and the SAML exchange should work.

I hope this information is helpful to you. If you have any questions, please do not hesitate to let me know.