Skip to main content

Troubleshooting SSO Issues

Common SSO Problems​

SAML Assertion Errors​

Symptom: "SAML assertion validation failed"

Solutions:

  1. Verify the ACS URL matches exactly (including trailing slashes)
  2. Check clock skew between your IdP and SureStage (must be < 5 minutes)
  3. Ensure the IdP certificate hasn't expired
  4. Verify attribute mapping includes email (required)

User Not Provisioned​

Symptom: SSO login succeeds but "user not found in organization"

Solutions:

  1. Verify the user's email in the IdP matches their SureStage email
  2. Check if just-in-time provisioning is enabled
  3. If using SCIM, verify the provisioning sync is active
  4. Manually invite the user first, then they can use SSO

SSO Enforcement Lockout​

Symptom: Admin locked out after enabling SSO enforcement

Solutions:

  1. Contact SureStage support for emergency access
  2. Use the backup admin email (set during SSO configuration)
  3. Access the API directly with an existing API key to disable enforcement

Diagnostic Checklist​

  • IdP metadata URL is accessible from SureStage
  • ACS URL and Entity ID match exactly
  • Required attributes (email) are mapped
  • IdP certificate is valid and not expired
  • User exists in both IdP and SureStage with matching email
  • Clock skew is less than 5 minutes