We are setting up SSO with a custom SAML identity provider. The SAML validator passes just fine:

But then when we try to login, we get:

I can't see any error logs anywhere (login/history). The strangest thing is that we have a parallel setup with ADFS working perfectly.

I can't see any differences between our custom IdP and ADFS. Any ideas on how to troubleshoot?


1 Answer 1


I found the issue:

The SAML Validator accepts encoded + ziped responses, but SalesForce doesn't. It only accepts encoded tokens (no zip).

Please fix the validator so it matches the actual endpoint!

  • 1
    Forwarding this to the Identity team right now!
    – metadaddy
    May 1, 2013 at 18:12
  • 1
    Interesting. Can you elaborate on why you'd be providing a zipped SAML response...? May 1, 2013 at 18:16
  • @metadaddy, can you show them this: success.salesforce.com/ideaView?id=08730000000hk0FAAQ
    – Mike Chale
    May 1, 2013 at 18:48
  • @chuck: what was confusing was that the SAML Validator reads: Enter your SAML response in base64-encoded, deflated and base64-encoded, or plain xml format into the field below, and click Validate. I just assumed that it supported both. I don't need it. I don't expect very large tokens to be sent anyway. It didn't occur to me that the SF.COM endpoint only supported encoded. Makes sense? May 2, 2013 at 3:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .