I have configured an Elastic SSO Identity Provider, and added Salesforce as a Service Provider. I also configured a Custom Domain. When I access Salesforce custom domain on the browser, it properly redirects to the Elastic SSO Login page. But after login, Salesforce says "Unable to login using your identity provider."

I then go to Elastic SSO Transaction Log, pick up the SAML Response and paste it into Salesforce SAML Assertion Validator in the Single Sign On settings page. Here, I find the following error:

Subject: myname@abcxyz.com

Unable to map the subject to a Salesforce.com user.

Of course, the two are different - My Salesforce ID (if I login directly using https://login.salesforce.com is myname@abc123.com and in the Elastic SSO, it is myname@abcxyz.com

How do I tell Elastic SSO that the name it should assert is myname@abc123.com? Besides this, I also get the following errors in the SAML Assertion Validator page.

11. Validating the Signature</p>
  <p>Is the response signed? true</p>
  <p>Is the assertion signed? true</p>
  <p>The reference in the response signature is valid</p>
  <p>The signature in the assertion is not valid</p>
  <p>The reference in the assertion signature is valid</p>
  <p>Is the correct certificate supplied in the keyinfo? true</p>
  <p>Signature or certificate problems</p>
  <p>The signature in the response is not valid</p>

I am using a self-signed certificate for testing.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.