I am trying to integrate the SAML 2.0 infrastructure on my web app with the internal identity provider built in to Salesforce.

I am having no problems with IdP-initiated authentication. That is, if I use the IdP-Initiated Login URL shown in the Build / Create / Apps / Edit screen, things work fine. The Salesforce SAML IdP sends a valid Assertion to my app. My app verifies the Assertion, drops its session cookie on the user's browser, and does its thing.

But, when I try to send a SAML Authn Request to sf's SP-Initiated Redirect Endpoint, the request fails right away. The message is "Insufficient Privileges You do not have the level of access ..."

It seems to fail very fast, without doing anything. Sending a corrupt AuthnRequest, or even no AuthnRequest, fails in exactly the same way.

I'm using a developers' domain (https://glance-dev-ed.my.salesforce.com/) if that makes a difference.

Is there a configuration setting I need to allow service-provider-initiated connections? I know I'm missing something.

  • Post your auth request and the SAML config on SF side
    – identigral
    Jul 10, 2015 at 2:34

1 Answer 1


I'm the original questioner.

When I use the service-provider-initiated AuthnRequest using the SP-Initiated POST Endpoint it works. Salesforce.com's authentication screen correctly prompts the user to login.

AuthnRequest operations sent via the SP-Initiated Redirect Endpoint don't work. They cause the "Insufficient Privileges" message. In the Login History page, this shows up as "Unable to parse AuthnRequest from SAML 2.0 Service Provider"

So, the answer to my problem is to use the POST endpoint and technique rather than the redirect endpoint.

Edit: Salesforce.com's internal identity provider ignores the Assertion Consumer Service (ACS) URL the service provider sends it inside the SAML AuthnRequest. Instead, it always returns the Assertion to the ACS in the Connected App profile. So, a successful deep-link sort of signon will require the use of the RelayState parameter.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .