Salesforce Stack Exchange is a question and answer site for Salesforce administrators, implementation experts, developers and anybody in-between. It only takes a minute to sign up.
Sign up to join this community
I've been trying to set up SSO for Marketing Cloud with Azure AD following this article. When testing the connection the browser displays this error message:
"Incoming SAML message is not properly formatted, or has elements which are missing or invalid. Unable to establish security of incoming assertion"
Does anyone know troubleshooting for this?
Thanks in advance!
Did you look at the documentation?
Single Sign-On Error Resolution in Your Marketing Cloud Account
Incoming SAML message is not properly formatted, is missing elements, or includes invalid elements
Message was signed but signature could not be verified - This reason indicates that the system could not validate the signature contained in the message with the certificate data contained in the identity provider metadata configured with the account.
Assertion contains an unacceptable Audience Restriction - This reason indicates that the message did not contain the expected Audience Restriction value of https://sp.exacttarget.com/shibboleth-sp.
Assertion is no longer valid OR Message expired, was issued too long ago - Both of these reasons indicate issues with the message timestamps occurring outside the allowed clock skew range. This issue can occur if the system clock for the server generating the SAML messages is out-of-date. To correct this error, ensure the clock on the server generating the SAML messages provides an up-to-date value .
SAML response contained an error - This message typically indicates that the Marketing Cloud received a SAML message from an identity provider with an error status code, indicating something failed when processing the request at the identity provider. Ensure you properly configure the identity provider and that it returns the expected successful SAML message status codes.
Incoming SAML message has security elements which are missing or invalid
Message was signed but signature could not be verified - This reason indicates that the system could not validate the signature contained in the message with the certificate data contained in the identity provider metadata configured with the account.
Message expired, was issued too long ago - This reason indicates an issue with the message timestamps occurring outside the allowed clock skew range. This issue can occur if the system clock for the server generating the SAML messages is out-of-date. Ensure the clock on the server generating the SAML messages provides an up-to-date value to correct this error.
Rejecting replayed message ID () - This message indicates that the system already received the SAML message with the provided ID. Ensure that the identity provider includes unique message IDs for all SAML messages it generates.
