# SAML Group Attributes with more than one group **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-security\ **Created:** [October 25, 2019, 3:34pm UTC](https://discuss.elastic.co/t/saml-group-attributes-with-more-than-one-group/205295 "2019-10-25T15:34:41Z")\ **Posts on this page:** 1\ **Showing post:** 10
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [October 29, 2019, 12:18pm UTC](https://discuss.elastic.co/t/saml-group-attributes-with-more-than-one-group/205295/10 "2019-10-29T12:18:12Z")
Let's take a step back. Many of us chimed in to help and it might got confusing, apologies. The latest error you get now isn't related to the changes I suggested, but to the changes you did due to what Tim was suggesting, which unfortunately weren't enough to address his points. > [@ramss](#): > > I have added your changes and I think it is matching the values now. It doesn't. What you have done now is configure ADFS to release a NameID without a format. This is again almost always wrong. You _don't have to_ use a NameID, but if you do, you need to configure it correctly. We can't help you much with your ADFS configuration, but you need to - either figure out how to release a NameID with persistent format ( based on the value of some attribute ) and configure elasticsearch to map this to the principal property - or use any other attribute to map to the principal property. I.e. UPN The possibilities for correct configuration are many and there isn't a better/simple/only one I can suggest. So I'll suggest _one_ that works and feel free to alter this to your liking. 1. Configure ADFS to release a persistent NameID. There's enough ADFS related documentation around this, i.e. see [Name Identifiers in SAML assertions | Microsoft Learn](https://blogs.msdn.microsoft.com/card/2010/02/17/name-identifiers-in-saml-assertions/) and check the section with subtitle " Persistent name identifier". You need to select which value AD you would pass as the value of the NameID ( == what you should select for `Incoming claim type" in the screenshot ), UPN is a good candidate. 2. Change `nameid_format: urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified` to `nameid_format: urn:oasis:names:tc:SAML:2.0:nameid-format:persistent` in your configuration. 3. Leave everything else as is. --- _[View the full topic](https://discuss.elastic.co/t/saml-group-attributes-with-more-than-one-group/205295)._