Some helpful diagnostics to do:
- Go to
Setup | Single Sign-on Settings, choose your SSO configuration and click Saml Assertion Validator within 480 seconds of the error. In my case, I got back
Unable to map the subject to a Salesforce user.
- This error is indicative of a mismatch between the supplied federation Id from the Identity provider and the configured
User.FederationId in SFDC. In our case, we were using email format to be the federation Id
But after checking both Okta and SFDC, the same email
firstname.lastname@example.org was configured. Hmm.
Next diagnostic was to install a SAML Tracer like this one (Firefox) and rerun the login from the Okta application screen. The SAML tracer (see the SAML tab for the POST message highlighted as SAML in the console) showed that no value was passed in the
<saml:NameId> XML tag. That is,
email@example.com was nowhere to be found in the assertion.
This was not an SFDC issue but an Okta setup issue. The Okta user had no value for its Federation Id attribute. There was a UserName, email, first/last but no value for Federation Id. Rather than manually adding this value to every Okta user, we did:
- Okta allows SFDC users to be provisioned directly once added to Okta. The Salesforce (Federated Id) configuration forces you to set this up, even if you don't need to do this (burning an integration user seat in the process). WE had the Create/Update check boxes unchecked.
- You need to map an Okta field (like Email) to the Salesforce field Federation Id in
Okta Profile Editor. This gives the Okta user a value to pass in the SAML assertion when requested by the Service Provider (Salesforce)