I've got SSO using SAML setup and working fine, and am trying now to get it so JIT provisioning is working as well, so users in my company can easily be created/updated in Salesforce automatically when logging in.

I've got it setup, and feel confident it's setup correctly according to the Salesforce docs, but it fails for some unspecified reason, and the "SAML Validator" is only giving me a single error message:

Unable to map the subject to a Salesforce.com user

How can I find out what's going on?

1 Answer 1


Even though Salesforce doesn't display it clearly here, there is additional error information available that can help you figure this out. It's contained in the url of the login request when it fails.

For example, When I try and login and it fails, I get this error message from Salesforce.

enter image description here

I finally noticed that the url has an error code and description in it that's very helpful! In this case, the ErrorCode=5 parameter helps me out alot, as it can be looked up here in Salesforce's docs!


  • A nice tool to help identify SAML errors when integrating with Salesforce can be found here
    – Brad Parks
    Commented Oct 14, 2016 at 13:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .