Troubleshooting SAML, OAuth and JIT login failures
A failure, cause and fix catalog for single sign-on: SAML Login History statuses and the SAML Assertion Validator, JIT error codes and the Custom Error URL, OpenID Connect and OAuth error codes, JWT bearer audience and subject mistakes, and certificate rotation in both directions.
Given a scenario, troubleshoot common points of failure that may be encountered in a single sign-on solution (SAML, OAuth, etc.).
~7 min read · 16 practice questions ·
What the exam expects
- Read a SAML Login History status, decide whether it is an assertion problem or a configuration problem, and name the fix.
- Use the SAML Assertion Validator correctly, and route failed logins to a branded page with the Custom Error URL.
- Map JIT error codes (11, 14, 16) to their causes, and reactivate returning site users through JIT.
- Diagnose OpenID Connect and OAuth errors (No_Openid_Response, ERROR_CREATING_USER, server_error, invalid_grant) and JWT bearer audience and subject mistakes.
- Recognize which certificate rotation broke which login direction.
Key terms: Login History status (the reason a login failed); SAML Assertion Validator (Setup tool that checks an assertion against Salesforce's requirements); JIT error code (number returned in the error page URL); Custom Error URL (public page users reach on a login error); invalid_grant (OAuth token-request error with many causes, including a bad audience).
Key facts
- Detail
- Within 5 minutes of the timestamp, plus or minus 3 minutes
- Detail
- A repeated assertion ID
- Detail
- Assertion errors only; other problems in Login History
- Detail
- Plain XML, base64, or deflated and base64
- Detail
- Must be publicly accessible
- Detail
- License limit exceeded
- Detail
- Username change isn't allowed for an existing user
- Detail
- No unique profile ID for the given profile name
- Detail
- Updated but left inactive unless User.IsActive is true
- Detail
- User Info Endpoint URL is invalid
- Detail
- Hourly authorization request limit exceeded
- Detail
https://login.salesforce.com
Sources for this section (7)
- SAML Login Errorshelp.salesforce.com (opens in a new tab)
- Troubleshoot SAML Assertion Errorshelp.salesforce.com (opens in a new tab)
- Create a SAML SSO Settinghelp.salesforce.com (opens in a new tab)
- JIT Errorshelp.salesforce.com (opens in a new tab)
- JIT Fields for Experience Cloudhelp.salesforce.com (opens in a new tab)
- OAuth 2.0 Authorization Errorshelp.salesforce.com (opens in a new tab)
- JWT Bearer Flowhelp.salesforce.com (opens in a new tab)
- Why does Assertion Expired appear only for logins from some IdP servers behind a load balancer?
- When should you run the SAML Assertion Validator again after fixing errors?
- What does JIT error 16 tell you after a profile rename?
- Which field must change when an OpenID provider issues ID tokens with a new issuer?
The questions are free to read. Answers with their sources and self-grading are included with the pack.
Keep reading with the Platform Identity and Access Management Architect pack
- Core concepts
- Exam traps
- Worked scenario
The pack includes:
- All 25 lessons of the Platform Identity and Access Management Architect guide, with reading progress
- Interactive decision walks and step-by-step sequence steppers
- Inline practice questions and one-click topic practice (16 questions for this lesson)
- An official source cited for every claim
- An AI tutor that answers from the guide
- Unlimited timed practice exams