What are Common Errors or Problems Encountered on the Single Sign On page?

Common errors and problems encountered on the Single Sign-On (SSO) page typically fall into 1 of 3 categories:

• Configuration mismatches
• Technical handshake failures
• Post-login permission issues

1. Configuration & Mapping Errors

• Claim URI Mismatches:
• • This is the most frequent cause of failure.
  • The Claim URIs (the long URLs like http://schemas.xmlsoap.org/...) must match exactly between your Identity Provider (IdP) and the Spirion Data Mapping fields.
  • Even a single trailing slash or character difference will cause the login to fail.
• Incorrect Role Identifiers:
• • When mapping roles, you must use the correct identifier for your provider.
  • For Microsoft Entra ID (Azure AD), you must use the Object ID of the group.
  • For Okta or ADFS, you typically use the Group Name.
  • Using the wrong type of identifier will result in a successful login but a "blank" console with no permissions.
• Metadata URL Issues:
• • Providing an incorrect or unreachable Identity Provider Metadata URL will prevent Spirion from automatically discovering the necessary certificates and endpoints, requiring manual (and error-prone) configuration.

2. Technical Handshake Failures

• XML Parsing Error (IDX13102):
• • This occurs when the IdP sends authentication context information in a format that Spirion's security libraries cannot interpret (often because the value is not a valid absolute URI).
  • This is resolved by enabling the Ignore Authentication Context In Response setting.
• Correlation ID Mismatch:
• • Users may see an "Unexpected Response" error if they have multiple login tabs open or if a load balancer is not preserving the session state.
  • This happens when the InResponseTo ID in the SAML response doesn't match the original request ID.
• Signature Validation Failures:
• • If the IdP requires signed requests but Spirion isn't configured to sign them (or vice versa), the handshake will fail immediately.
  • This is managed via the Authentication Request Signing Behavior setting.

3. Post-Login & Workflow Issues

• "Page Not Found" After Login:
• • This usually indicates a network architecture issue where a reverse proxy or load balancer is redirecting the user to an internal address they cannot reach.
  • Setting the Public Origin field to your console's public URL resolves this.
• Audit Log Gaps:
• • In some versions, successful SSO logins may not be recorded in the Spirion Audit Log even if they are successful in the IdP logs.
  • This is a known issue (AL-34310) that requires a console update to resolve.
• Logout Failures:
• • If a user logs out but their session remains active, it may be because the IdP is sending an unsigned logout response that Spirion is rejecting.
  • Enabling Accept Unsigned Logout Responses is the common fix for this.

Recommendations

Always use the Identity Claims button in the Data Mapping section after uploading your metadata; it is the most reliable way to avoid manual typing errors in Claim URIs.