What is the solution for the "The response assertion is missing a required attribute" error faced by our user when she logs in to her Docusign account.

I don't have an answer but we are seeing the same issue.

I have the same issue as well

Anyone know? duo and docusgn certainly don't.

Would like to know this as well...

Duo (our 2FA) have been extremely helpful -spent hours with me on this - here is their reply -

"Was DocuSign support able to identify the missing attribute that is generating the error message during their ingestion of the saml response?

  If they can identify what attribute is missing or misconfigured, specifically, we can correct that in the generic service provider settings and send them the correct attribute, we just need to know what is wrong. Their system is ingesting the saml response and generating the error message. Only they can identify the cause."

docusign - "Its not us, it's them, but we can't tell why"

Cheers - One question Is the Azure(we don't use it) attribute listed first - Looks like I will have to create custom Attributes on the Duo side.

Looks like the right side is the "source" (Azure?) data. here are a couple of screenshots:

Ok, so with no thanks to DocuSign support, some thanks to Duo support (at least they would go over things) and many thanks to Nick for pointing me in the correct direction.

Here is the answer for Duo generic SAML

Docusign, your documentation sucks .

These posts helped guide me to the answer for us. Thanks!

A user encountered this issue and within our AD, his EmailAddress field was null. Update this to the correct value and he could log in.

Mate you are a legend. I honestly cant say thanks enough! We are moving to DocuSign over to Duo hosted SSO and this one was killing me. DocuSign documentation is shocking! However what you have provided as got me up and running. Again big thanks mate.

- Cheers! - glad I could help.

Here is the solution that worked for me to resolve the error, “The response assertion is missing a required attribute.”

Microsoft Entra had a default Name identifier format set to Email address. However, the saml2 response, once decoded, showed that DocuSign expected the format to be Persistent. After changing the Name identifier format to Peristent, the SSO worked.

<NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent">