We are setting up SSO with a custom SAML identity provider. The SAML validator passes just fine:

But then when we try to login, we get:

I can't see any error logs anywhere (login/history). The strangest thing is that we have a parallel setup with ADFS working perfectly.

I can't see any differences between our custom IdP and ADFS. Any ideas on how to troubleshoot?


I found the issue:

The SAML Validator accepts encoded + ziped responses, but SalesForce doesn't. It only accepts encoded tokens (no zip).

Please fix the validator so it matches the actual endpoint!

  • 1
    Forwarding this to the Identity team right now!
    – metadaddy
    May 1 '13 at 18:12
  • 1
    Interesting. Can you elaborate on why you'd be providing a zipped SAML response...? May 1 '13 at 18:16
  • @metadaddy, can you show them this: success.salesforce.com/ideaView?id=08730000000hk0FAAQ
    – Mike Chale
    May 1 '13 at 18:48
  • @chuck: what was confusing was that the SAML Validator reads: Enter your SAML response in base64-encoded, deflated and base64-encoded, or plain xml format into the field below, and click Validate. I just assumed that it supported both. I don't need it. I don't expect very large tokens to be sent anyway. It didn't occur to me that the SF.COM endpoint only supported encoded. Makes sense? May 2 '13 at 3:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.