Below are some common problems and alerts you may encounter with Single-Sign On, along with some tips and resources to help you troubleshoot, including:
If you have an existing Relay State, then you may leave it as is.
If you are configuring SAML/SSO for Salesloft for the very first time, it is advised to leave the Relay State blank.
This error message is due to the RelayState. RelayState is not required in the ACS URL.
If you previously had a RelayState in the ACS URL, you may need to remove it.
This error may occur when you click the Test Login.
The error means you have not assigned this application to your profile during setup in Okta. Go back to this step and assign the app, and then try again.
Typically this happens when you uploaded the wrong file or file type, such as a CSV. Please check that you are uploading the metadata XML file you downloaded from Okta. This could also happen if your metadata file is corrupted; when this happens, you can usually re-download a fresh copy of the metadata file and try again.
The email address provided by the identity provider as the name_id must match the login email address of the user in Salesloft. This error either indicates that the user does not have a Salesloft account, or the account was made with a slightly different email address.
Salesloft requires the user's email address in the name_id attribute.
Check the settings in the identity provider to ensure that this attribute is included.
This indicates that the identity provider rejected the login attempt. This can be for any number of reasons, but it is likely caused by some mis-configuration of the identity provider, like having an incorrect ACS URL for example.
This indicates that the login request fails Salesloft's validation checks. The specific validation error can be seen by using the "Test Login" button on the SAML settings page. Some common validation errors are listed below:
- "Invalid Signature on SAML Response" - The certificate that was used for this login attempt did not match the certificate that was uploaded to Salesloft in the SAML metadata file. Check the certificate, upload a new metadata file, and try again.
- "Salesloft is not a valid audience for this Response - Valid audiences: Salesloft" - Check the spelling of "Salesloft" as the Identifier or Entity ID in your Identity Provider. Capitalization is important.
Are admins supposed to see another button that would be visible in an admin account or is that all that should be there?
When SSO is on, there is only a Disable SSO button, no other button to upload new metadata.
If you want to switch IDPs, you need to disable SSO and then upload the new metadata from the new IDP
Since SSO is turned on for all users, will disabling it log me out of the account that I am currently using?
If you disable SSO while you are already logged in, you will stay logged in. When SSO is disabled, all users attempting to log in will need to use username/password and use the forgot password link to make a new password
