“Unable to resolve request into a Service Provider” return by Salesforce Identity Provider for SAML 2.0 request

Question

I have a Salesforce instance configured to act as an Identity Provider and am trying to connect a (non-Salesforce) Service Provider (client) to it. So we are making a SAML 2.0 samlp:AuthnRequest using the HTTP POST binding. Using the "Identity Provider Event Log" has been helpful for solving the initial problems.

But I am now stuck with this error:

Unable to resolve request into a Service Provider

and have not found any clear suggestions as to the cause by Googling.

("The "Service Provider" is the client and each "Service Provider" is represented by a "Connected App" in the Salesforce Identity Provider org.)

It would be helpful to understand how Salesforce handles the case of samlp:AuthnRequest requests being made when there are multiple "Connected App" definitions. The only element in common between those two appears to the (samlp:AuthnRequest) AssertionConsumerServiceURL and the (Connected App) ACS URL. I've tried tweaking these with no success (e.g. adding trailing slashes).

I note that the "IdP-Initiated Login URL" values include an app parameter that is different for each "Connected App".

Any explanation, insight, suggestions or solutions very welcome.

Answer 1

This usually has to do with the Entity ID field being incorrect in the Service Provider's Single Sign-On Configuration. Make sure it's the Service Provider's domain URL, not the Identity Provider's domain URL. (Which is kind of confusing because, why would you be entering the URL of the org you are already in? But that's how it is...)

This refers to step 5.7 of Implementing Single Sign-On Across Multiple Organizations.