I am working on enabling SSO for our organization with Google.

I setup the Single Sign-On Configuration.

SAML Identity Type: Assertion contains the Federation ID from the User object

SAML Identity Location: dentity is in the NameIdentifier element of the Subject statement

Service Provider Initiated Request Binding:

Below is the error I continue to receive. How can I better debug this to understand whether or not this is a Salesforce or Google issue?

Domain with Error Message: https://company.my.salesforce.com/_nc_external/identity/saml/SamlError

enter image description here

    <saml2p:StatusMessage>Invalid request, ACS Url in request
        https://company.my.salesforce.com?sc=0LE4x000000LRkV doesn't match configured ACS Url

Inside the Single Sign On setup you have created, there is a button called "SAML Assertion Validator" that should give you more detail on where it failed.

Btw, since you are using Google, have you considered using Auth Providers? https://help.salesforce.com/articleView?id=sf.sso_provider_sfdc.htm&type=5

  • Yes, I cannot get that one to work either. SSO has been a bit of a nightmare for me so far! I have no idea how to use the SAML Assetion Validator: Enter your SAML response in base64-encoded, deflated and base64-encoded, or plain XML format into the field below, and click Validate. Mar 7 at 3:48
  • another way I would tackle this is to download a chrome plugin named 'SAML-Tracer' that should also give you a good idea on where it fails
    – Mark Tayag
    Mar 7 at 3:55
  • <saml2p:StatusMessage>Invalid request, ACS Url in request company.my.salesforce.com?sc=0LE4x000000LRkV doesn't match configured ACS Url company.my.salesforce.com?so=00D4x000003wk2I.</…> Mar 7 at 3:55
  • ah ok, check your configuration in Google, and update the Entity Id to match what you put in the Single Sign On setup
    – Mark Tayag
    Mar 7 at 4:08
  • Our Entity ID for the single sign-on is: includedhealth.my.salesforce.com Do I need to copy this and paste this somewhere in google? Mar 7 at 4:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.