3

Given:

When user attempts to login from Okta applications page

Then

  • User gets error saying problem with single signon

Notes:

  • No JIT, no Community; just plain old internal user Salesforce login via SSO

2 Answers 2

4

Some helpful diagnostics to do:

  • Go to Setup | Single Sign-on Settings, choose your SSO configuration and click Saml Assertion Validator within 480 seconds of the error. In my case, I got back Unable to map the subject to a Salesforce user.
  • This error is indicative of a mismatch between the supplied federation Id from the Identity provider and the configured User.FederationId in SFDC. In our case, we were using email format to be the federation Id

But after checking both Okta and SFDC, the same email xxx@mycompany.com was configured. Hmm.

Next diagnostic was to install a SAML Tracer like this one (Firefox) and rerun the login from the Okta application screen. The SAML tracer (see the SAML tab for the POST message highlighted as SAML in the console) showed that no value was passed in the <saml:NameId> XML tag. That is, xxx@mycompany.com was nowhere to be found in the assertion.

Resolution

This was not an SFDC issue but an Okta setup issue. The Okta user had no value for its Federation Id attribute. There was a UserName, email, first/last but no value for Federation Id. Rather than manually adding this value to every Okta user, we did:

  • Okta allows SFDC users to be provisioned directly once added to Okta. The Salesforce (Federated Id) configuration forces you to set this up, even if you don't need to do this (burning an integration user seat in the process). WE had the Create/Update check boxes unchecked.
  • You need to map an Okta field (like Email) to the Salesforce field Federation Id in Okta Profile Editor. This gives the Okta user a value to pass in the SAML assertion when requested by the Service Provider (Salesforce)
1

In addition to cropredy's answer (which was a great starting point), we had updated the Okta setup from "Secure Web Authentication" to "SAML 2.0". Everything was setup correctly, but when viewing the SAML assertion in Salesforce, it was showing the error "Unable to map the subject to a Salesforce user".

Looking in Okta, the assignments for each user was blank. (see below)

To resolve this, we removed the assignments and re-added the group. This resulted in the assignments being updated and SSO working.

assignments are blank

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.