5

Given:

When user attempts to login from Okta applications page

Then

  • User gets error saying problem with single signon

Notes:

  • No JIT, no Community; just plain old internal user Salesforce login via SSO

2 Answers 2

7

First principles

  • If your SFDC Single Signon configuration SAML Identity type is Federation Id, then the configured Federation Id in Okta has to match the SFDC user with that Federation Id
  • If your SFDC Single Signon configuration SAML Identity type is UserName, the Okta value passed to Salesforce has to match the Salesforce UserName, not the Salesforce Federation Id

Assuming you have this correct ...

Some helpful diagnostics to do:

  • Go to Setup | Single Sign-on Settings, choose your SSO configuration and click Saml Assertion Validator within 480 seconds of the error. In my case, I got back Unable to map the subject to a Salesforce user.
  • This error is indicative of a mismatch between the supplied federation Id from the Identity provider and the configured User.FederationId in SFDC. In our case, we were using email format to be the federation Id

But after checking both Okta and SFDC, the same email [email protected] was configured. Hmm.

Next diagnostic was to install a SAML Tracer like this one (Firefox) and rerun the login from the Okta application screen. The SAML tracer (see the SAML tab for the POST message highlighted as SAML in the console) showed that no value was passed in the <saml:NameId> XML tag. That is, [email protected] was nowhere to be found in the assertion.

Resolution

This was not an SFDC issue but an Okta setup issue. The Okta user had no value for its Federation Id attribute. There was a UserName, email, first/last but no value for Federation Id. Rather than manually adding this value to every Okta user, we did:

  • Okta allows SFDC users to be provisioned directly once added to Okta. The Salesforce (Federated Id) configuration forces you to set this up, even if you don't need to do this (burning an integration user seat in the process). We had the Create/Update check boxes unchecked.
  • You need to map an Okta field (like Email) to the Salesforce field Federation Id in Okta Profile Editor. This gives the Okta user a value to pass in the SAML assertion when requested by the Service Provider (Salesforce)
2

In addition to cropredy's answer (which was a great starting point), we had updated the Okta setup from "Secure Web Authentication" to "SAML 2.0". Everything was setup correctly, but when viewing the SAML assertion in Salesforce, it was showing the error "Unable to map the subject to a Salesforce user".

Looking in Okta, the assignments for each user was blank. (see below)

To resolve this, we removed the assignments and re-added the group. This resulted in the assignments being updated and SSO working.

assignments are blank

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .