# Troubleshooting SAML, OAuth and JIT login failures

*Platform Identity and Access Management Architect Study Guide · Identity Management Concepts · Last updated October 16, 2026 · https://www.certifyforce.com/study-guide/identity-and-access-management-architect/identity-management-concepts/troubleshooting-saml-oauth-and-jit-login-failures*

A failure, cause and fix catalog for single sign-on: SAML Login History statuses and the SAML Assertion Validator, JIT error codes and the Custom Error URL, OpenID Connect and OAuth error codes, JWT bearer audience and subject mistakes, and certificate rotation in both directions.

- Certification: Salesforce Platform Identity and Access Management Architect
- Exam section: Identity Management Concepts
- Study guide: https://www.certifyforce.com/study-guide/identity-and-access-management-architect

**Official exam objective:**

> Given a scenario, troubleshoot common points of failure that may be encountered in a single sign-on solution (SAML, OAuth, etc.).

## What the exam expects

- Read a SAML Login History status, decide whether it is an assertion problem or a configuration problem, and name the fix.
- Use the SAML Assertion Validator correctly, and route failed logins to a branded page with the Custom Error URL.
- Map JIT error codes (11, 14, 16) to their causes, and reactivate returning site users through JIT.
- Diagnose OpenID Connect and OAuth errors (No_Openid_Response, ERROR_CREATING_USER, server_error, invalid_grant) and JWT bearer audience and subject mistakes.
- Recognize which certificate rotation broke which login direction.

Key terms: **Login History status** (the reason a login failed); **SAML Assertion Validator** (Setup tool that checks an assertion against Salesforce's requirements); **JIT error code** (number returned in the error page URL); **Custom Error URL** (public page users reach on a login error); **invalid_grant** (OAuth token-request error with many causes, including a bad audience).

## Key facts

| Fact | Detail | Source |
|---|---|---|
| Assertion window | Within 5 minutes of the timestamp, plus or minus 3 minutes | [SAML Login Errors](https://help.salesforce.com/s/articleView?id=xcloud.sso_saml_validation_errors.htm&language=en_US&type=5) |
| Replay Detected | A repeated assertion ID | [SAML Login Errors](https://help.salesforce.com/s/articleView?id=xcloud.sso_saml_validation_errors.htm&language=en_US&type=5) |
| Validator scope | Assertion errors only; other problems in Login History | [Troubleshoot SAML Assertion Errors](https://help.salesforce.com/s/articleView?id=xcloud.sso_saml_validation.htm&language=en_US&type=5) |
| Validator input | Plain XML, base64, or deflated and base64 | [Troubleshoot SAML Assertion Errors](https://help.salesforce.com/s/articleView?id=xcloud.sso_saml_validation.htm&language=en_US&type=5) |
| Custom Error URL | Must be publicly accessible | [Create a SAML SSO Setting](https://help.salesforce.com/s/articleView?id=xcloud.sso_service_provider_configuration.htm&language=en_US&type=5) |
| JIT error 11 | License limit exceeded | [JIT Errors](https://help.salesforce.com/s/articleView?id=xcloud.sso_jit_errors.htm&language=en_US&type=5) |
| JIT error 14 | Username change isn't allowed for an existing user | [JIT Errors](https://help.salesforce.com/s/articleView?id=xcloud.sso_jit_errors.htm&language=en_US&type=5) |
| JIT error 16 | No unique profile ID for the given profile name | [JIT Errors](https://help.salesforce.com/s/articleView?id=xcloud.sso_jit_errors.htm&language=en_US&type=5) |
| Inactive site user at JIT login | Updated but left inactive unless User.IsActive is true | [JIT Fields for Experience Cloud](https://help.salesforce.com/s/articleView?id=xcloud.sso_jit_community_requirements.htm&language=en_US&type=5) |
| No_Openid_Response | User Info Endpoint URL is invalid | [OAuth 2.0 Authorization Errors](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_flow_errors.htm&type=5) |
| server_error | Hourly authorization request limit exceeded | [OAuth 2.0 Authorization Errors](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_flow_errors.htm&type=5) |
| JWT aud for production | `https://login.salesforce.com` | [JWT Bearer Flow](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_jwt_flow.htm&type=5) |

## Check yourself

- Why does Assertion Expired appear only for logins from some IdP servers behind a load balancer?
- When should you run the SAML Assertion Validator again after fixing errors?
- What does JIT error 16 tell you after a profile rename?
- Which field must change when an OpenID provider issues ID tokens with a new issuer?

## Sources

- [SAML Login Errors](https://help.salesforce.com/s/articleView?id=xcloud.sso_saml_validation_errors.htm&language=en_US&type=5)
- [Troubleshoot SAML Assertion Errors](https://help.salesforce.com/s/articleView?id=xcloud.sso_saml_validation.htm&language=en_US&type=5)
- [Review the Login History](https://help.salesforce.com/s/articleView?id=sf.sso_saml_login_history.htm&language=en_US&type=5)
- [Just-in-Time Provisioning Errors](https://help.salesforce.com/s/articleView?id=xcloud.sso_jit_errors.htm&language=en_US&type=5)
- [Just-in-Time SAML Assertion Fields for Salesforce](https://help.salesforce.com/s/articleView?id=sf.sso_jit_requirements.htm&language=en_US&type=5)
- [Just-in-Time SAML Assertion Fields for Experience Cloud](https://help.salesforce.com/s/articleView?id=xcloud.sso_jit_community_requirements.htm&language=en_US&type=5)
- [Step 2: Create a SAML Single Sign-On Setting in Salesforce](https://help.salesforce.com/s/articleView?id=xcloud.sso_service_provider_configuration.htm&language=en_US&type=5)
- [Step 3: Share Your SAML SSO Configuration with Your Identity Provider](https://help.salesforce.com/s/articleView?id=xcloud.sso_saml_sp_endpoints.htm&language=en_US&type=5)
- [OAuth 2.0 Authorization Errors](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_flow_errors.htm&type=5)
- [OAuth 2.0 Refresh Token Flow for Renewed Sessions](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_refresh_token_flow.htm&language=en_US&type=5)
- [Configure an Authentication Provider Using OpenID Connect](https://help.salesforce.com/s/articleView?id=xcloud.sso_provider_openid_connect.htm&language=en_US&type=5)
- [OAuth 2.0 JWT Bearer Flow for Server-to-Server Integration](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_jwt_flow.htm&type=5)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 16 linked practice questions, and unlimited timed mock exams are included with the Platform Identity and Access Management Architect pack (USD $19): https://www.certifyforce.com/practice-exams