1

I try to setup SAML based SSO for a community.

I am basically following this instructions https://help.salesforce.com/apex/HTViewSolution?id=000198728&language=en_US and using Axiom tester ( Axiom single sign on tools - cant post link because of low reputation )

But when I click "login" button on Axiom final page i am displayed Salesforce login page and it says "To access this page, you have to log in to xxxxxxxx".

I checked the network data in the browser and I see that the endpoint where the saml assertion is posted returns "401 Unauthorized".

By the way this url is https://xxxxxxxxxx.ap2.force.com/hozen/login?so=12B39123456eXYZ

I am also using JIT user provisioning.

Can't understand what is going on and why I am not able to get logged in with SAML.

Thanks!

  • Did you ever figure this out? I'm having the same issue. – Tony Nov 2 '16 at 19:31
2

We had this happen to us recently and the solution was as follows:

The SAML attribute Account.Owner value referenced a deactivated User !

<Attribute Name="Account.Owner" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="Account.Owner">
            <AttributeValue>005R0000002UshX</AttributeValue>
</Attribute>

Specifically, the attribute value 005R0000002UshX was a deactivated user (we had switched to a different user but the IdP team never got the commo. Sigh.)

The Account.Owner has to be an active user and have CRUD access on Account as it becomes the CreatedById and OwnerId of any JIT-created Accounts. See related SFSE answer.

If active but does not have CRUD access, a different error results - CANNOT_INSERT_UPDATE_ACTIVATE_ENTITY Api Exception: entity type cannot be inserted: Account

Here are the relevant bits of the SAML assertion:

<Subject>
    <NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:emailAddress">foo@bar.com</NameID>
    <SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
        <SubjectConfirmationData InResponseTo="_2CAAAAVl1lXGQME8wUjAwMDAwMDAwMDA1AAAAzMYIMgcWJr1m4QSgPvlL9yROBUp0zOWZ6yHIf8zncqR6ryMQxyuBv-6gsqVTOSAUyP1lhgTtnmge0FjBUeLtQC0e6eUfhoIeShYWGo8E6PA-I8quqJCFicMonqs4fYyyU-QtrprWBK5vqRRzPwIazeydic-uTx397QEmDWSwS3GoraJYkBNpdoz07N1pbM99ESTcdsRnUN7Yv-P8Q1qT9FCAQAa8LqKByKKvvHvXIy-MtEaMk9xnS3sTo0JHYuukxg" NotOnOrAfter="2016-12-09T21:03:45Z" Recipient="https://full-myorg.cs2.force.com/mycustomers/login?so=someOrgId"/>
    </SubjectConfirmation>
</Subject>
<Conditions NotBefore="2016-12-09T21:00:40Z" NotOnOrAfter="2016-12-09T22:00:45Z">
    <AudienceRestriction>
        <Audience>https://full-myorg.cs2.force.com/</Audience>
    </AudienceRestriction>
</Conditions>
<AttributeStatement>
    <Attribute Name="User.Username" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="User.Username">
        <AttributeValue>foo@bar.com</AttributeValue>
    </Attribute>
    <Attribute Name="User.FirstName" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="User.FirstName">
        <AttributeValue>Fred</AttributeValue>
    </Attribute>
    <Attribute Name="User.LastName" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="User.LastName">
        <AttributeValue>Foo</AttributeValue>
    </Attribute>
    <Attribute Name="User.Email" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="User.Email">
        <AttributeValue>foo@bar.com</AttributeValue>
    </Attribute>
    <Attribute Name="User.ProfileID" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="User.ProfileID">
        <AttributeValue>00e15000001IvN5</AttributeValue>
    </Attribute>
    <Attribute Name="Contact.Email" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="Contact.Email">
        <AttributeValue>foo@bar.com</AttributeValue>
    </Attribute>
    <Attribute Name="Contact.FirstName" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="Contact.FirstName">
        <AttributeValue>Fred</AttributeValue>
    </Attribute>
    <Attribute Name="Contact.LastName" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="Contact.LastName">
        <AttributeValue>Foo</AttributeValue>
    </Attribute>
    <Attribute Name="Account.AccountNumber" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="Account.AccountNumber">
        <AttributeValue>36</AttributeValue>
    </Attribute>
    <Attribute Name="Account.Name" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="Account.Name">
        <AttributeValue>Acme Corp.</AttributeValue>
    </Attribute>
    <Attribute Name="Account.Owner" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="Account.Owner">
        <AttributeValue>005R0000002UshX</AttributeValue>
    </Attribute>
</AttributeStatement>
  • @Tony -- see this answer. Hope it helps – cropredy Dec 12 '16 at 19:45
  • This answer solved the problem for me. So, it seems like this should be chosen as the "Best Answer" – a_sdfc_developer Dec 20 '18 at 18:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.