6

I'm testing SSO with Google as the IDP into a sandbox. The button appears on the sandbox log in page, but when I use it, I cannot login to the sandbox.

Here is the log result:

  1. Results Last recorded SAML login failure: 2016-12-06T15:56:12.107Z Unexpected Exceptions Ok

    1. Validating the Status Ok
    2. Looking for an Authentication Statement Ok
    3. Looking for a Conditions statement Ok
    4. Checking that the timestamps in the assertion are valid Ok
    5. Checking that the Attribute namespace matches, if provided Not Provided
    6. Miscellaneous format confirmations Ok
    7. Confirming Issuer matches Ok
    8. Confirming a Subject Confirmation was provided and contains valid timestamps Ok

    9. Checking that the Audience matches Audience problems
    The audience in the assertion did not match the allowed audiences
    Allowed audiences: [https://ideglobal--BDERP.cs62.my.salesforce.com]

    1. Checking the Recipient Ok Organization Id that we expected: 00D5C0000000Mji Organization Id that we found based on your assertion: 00D5C0000000Mji
    2. Validating the Signature Is the response signed? false Is the assertion signed? true Is the correct certificate supplied in the keyinfo? true Ok
    3. Checking that the Site URL Attribute contains a valid site url, if provided Not Provided
    4. Looking for portal and organization id, if provided Ok
    5. Checking if session security level is valid, if provided Ok

Can you please help to troubleshoot?

Improve this question

3 Answers 3

Reset to default
2

The issue is because from the google auth provider your audience value is mismatched .

The value is required and must match the Entity ID from the single sign-on configuration.

Recheck your configuration in the google apps and ensure the audience parameter is sent properly .

Improve this answer
1

I had the same problem. The fix was to change the Entity Id in Google on the "Service Provider Details" to exactly match Salesforce.

In Google I had the EntityId set as https://myorgname-dev-ed.my.salesforce.com/

In Salesforce the SAML Single Sign-On Settings Entity ID was set to https://myorgname-dev-ed.my.salesforce.com

So something as simple as a "/" at the end was causing me headaches

I removed the "/" from Google and it worked. Interestingly enough, adding it to Salesforce also works.

Improve this answer
0

I had the same problem, and in my case, just was missing a backslash at the end on the configuration

Regards

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .