4

I have a Salesforce instance configured to act as an Identity Provider and am trying to connect a (non-Salesforce) Service Provider (client) to it. So we are making a SAML 2.0 samlp:AuthnRequest using the HTTP POST binding. Using the "Identity Provider Event Log" has been helpful for solving the initial problems.

But I am now stuck with this error:

Unable to resolve request into a Service Provider

and have not found any clear suggestions as to the cause by Googling.

("The "Service Provider" is the client and each "Service Provider" is represented by a "Connected App" in the Salesforce Identity Provider org.)

It would be helpful to understand how Salesforce handles the case of samlp:AuthnRequest requests being made when there are multiple "Connected App" definitions. The only element in common between those two appears to the (samlp:AuthnRequest) AssertionConsumerServiceURL and the (Connected App) ACS URL. I've tried tweaking these with no success (e.g. adding trailing slashes).

I note that the "IdP-Initiated Login URL" values include an app parameter that is different for each "Connected App".

Any explanation, insight, suggestions or solutions very welcome.

  • Is this question still in need of an answer? – Eric Dec 26 '16 at 3:14
  • @Eric Not for me. – Keith C Dec 26 '16 at 22:26
  • can we close it out somehow? – Eric Dec 26 '16 at 22:44
  • I am running into similar issue. I have verified my urls, issuers, ACS url etc. everything looks correct. Any other setting i need to check ? – apn Sep 10 '17 at 18:54
2

This usually has to do with the Entity ID field being incorrect in the Service Provider's Single Sign-On Configuration. Make sure it's the Service Provider's domain URL, not the Identity Provider's domain URL. (Which is kind of confusing because, why would you be entering the URL of the org you are already in? But that's how it is...)

This refers to step 5.7 of Implementing Single Sign-On Across Multiple Organizations.

  • Thanks... thats exactly waht the problem was for me. I had entered the Entity ID into Idp without the https:// prefix, but with the prefix on the SP. – dacology Jan 11 '17 at 16:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.