1

We are attempting to configure Single Sign On in our Salesforce Marketing Cloud sandbox. We already have SSO set up in Production.

We noticed that when we configure SSO in sandbox, the SSO in production breaks. We can't seem to be able to have both working at the same time.

We have enabled TSE (Tenant-Specific SP EntityID ) in Marketing Cloud sandbox (new feature) to be able to have a different Entity Id for this instance. In Azure, we have created a new app specifically for sandbox.

When either of the connection breaks and a user tries accessing the app via SSO, they are presented with the following error:

"SSO Fatal Profile ErrorIncoming SAML message is not properly formatted, or has elements which are missing or invalid. Message was signed, but signature could not be verified."

According to this link https://help.salesforce.com/s/articleView?id=sf.mc_overview_saml_error_resolution.htm&type=5, the reason indicates that the system could not validate the signature contained in the message with the certificate data contained in the identity provider metadata configured with the account.

We have checked the certificates and they match.

We have raised a case with helpdesk but have not have any luck so far. Has anyone experienced a similar issue when setting up SSO for 2 different MIDs who could shed some light on this?

Improve this question

1 Answer 1

Reset to default
0

I believe you are trying to configure Azure SSO with 2 different certificate for Production and Sandbox which is the normal way.

But what we have observed during our setup configuration is that, when Tenant-Specific Entity ID is enabled, we will not be able to use 2 different certificate when the instances are on same stack.

We had to use one certificate across all 3 instances we have(DEV, TEST, PROD) and use a cutom generic URL for accessing them because you will be getting a drop down to chose the instance you want to login.

So, you can try

  • Update both instance with same working certificate
  • Request Azure team to create a custom myapps.microsoft.com url using the tenantID they have created for your account.

when you login you will see screen similar to the below one to chose the account to which you want to login(depending on where you have valid user with SSO)

enter image description here

you can use the Service Provider Initiated Link from SFMC setup page, but we will have separate url for each tenant and no matter which one you use, you will end up in same login page to select the account.

Hope this would help you.

Improve this answer
3
  • Thank you @Ajith S for this valuable information! My understanding speaking with the Azure team is that a certificate is automatically generated for each environment because they are created as 2 different apps in Azure. When you say "Update both instance with same working certificate" which certificate would need to be used? Do they have to set up the app as a multi tenancy app or would we just upload one of the cert created in both SFMC sandbox and PROD? Also do we need to enable TSE setting in both sandbox and Production for this to work? Many Thanks
    – test 0101
    Commented Feb 21, 2022 at 0:32
  • I was in an impression that you have TSE enabled for both Production and Sandbox. If its only enabled for the sandbox and 2 separate app is created for them in azure, you might have to check with SFMC Support/Product team. The scenario which I have mentioned is applicable when both instances are enabled with TSE and then you can have a muti tenancy app at Azure side to generate single certificate for both instance. But again it requires a lot of trial and error.
    – Ajith S
    Commented Feb 21, 2022 at 7:54
  • thanks, we will enable both, we were just testing taht it would work in sandbox first but was planning to. But before we did i wanted to ensure what other issue we may encounter with the set up knowing full well SFMC doesn't work the same as SF service cloud. So what you are saying the Azure team would need to create a muti tenancy app at Azure for it to generate 1 certificate, thank you!
    – test 0101
    Commented Feb 21, 2022 at 23:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .