SAML sign-in fails

Check the Name ID format and the two addresses your identity provider holds

What you see

  • The identity provider shows 403 not_a_saml_app or app_not_configured_for_user.
  • Sign-in returns to the server with a forbidden error.

Why it happens

The server asks the identity provider for the user's email address as the Name ID, at addresses that must match its own name exactly. A different format, a missing trailing slash, or a browser signed in to another account makes sign-in fail.

  1. Try a private window

    The browser is often signed in to a different account than the one assigned to the app.

  2. Set the Name ID format

    In the identity provider's app, set the Name ID format to email address and send the user's primary email.

  3. Check the two addresses

    The ACS URL and the entity ID must match exactly, with the trailing slash on the entity ID. A provider that imports metadata can use the metadata address instead.

    ACS URL      https://your-server-name/saml/acs
Entity ID    https://your-server-name/
Metadata     https://your-server-name/saml/metadata

  4. Read the last error

    In the console, Settings, Authentication shows these values for your server and the last sign-in error.

Related problems

Find the setup link or password