1

I've got SSO using SAML setup and working fine, and am trying now to get it so JIT provisioning is working as well, so users in my company can easily be created/updated in Salesforce automatically when logging in.

I've got it setup, and feel confident it's setup correctly according to the Salesforce docs, but it fails for some unspecified reason, and the "SAML Validator" is only giving me a single error message:

Unable to map the subject to a Salesforce.com user

How can I find out what's going on?

1

Even though Salesforce doesn't display it clearly here, there is additional error information available that can help you figure this out. It's contained in the url of the login request when it fails.

For example, When I try and login and it fails, I get this error message from Salesforce.

enter image description here

I finally noticed that the url has an error code and description in it that's very helpful! In this case, the ErrorCode=5 parameter helps me out alot, as it can be looked up here in Salesforce's docs!

https://mytestsamlsetup.my.salesforce.com/_nc_external/identity/saml/SamlError?ErrorCode=5&ErrorDescription=Unable+to+create+user&ErrorDetails=DUPLICATE_USERNAME+Username+Api+Exception%3A+Duplicate+Username.%3Cbr%3EThe+username+already+exists+in+this+or+another+Salesforce+organization.+Usernames+must+be+unique+across+all+Salesforce+organizations.+To+resolve%2C+use+a+different+username+%28it+doesn%27t+need+to+match+the+user%27s+email+address%29.+

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.