Access denied indicates that either

1. The user has not been granted access to that repository or
2. The user does not have an appropriate license or
3. The login is not being correctly mapped, so Laserfiche doesn't give them the appropriate license
   1. To determine if this is the issue, you can use the claimstest page to check the username, SID, and group membership after the user has logged in
   2. If this is the case, the problem is either that (1) the user's unique attribute configuration is incorrect or (2) the SAML token is missing the unique attribute.

To grant the user access to the repository, you must make sure that the user or a group that the user belongs to is marked as "allow" in the admin console for that repository.

SAML users are managed under the "LFDS" section of the repository admin console.

SAML groups can be indirectly managed by adding a SAML group to a Directory Server group, then managing that group in the repository admin console. See the help files on managing SAML groups