Troubleshooting

SAML and OpenID Connect errors: cause and solution

Find your error message: each page gives the likely cause and the fix.

SAML

• “Invalid audience” / “Audience restriction”
• “Wrong ACS URL” / “Recipient” / “Destination”
• “Invalid signature” / “digest mismatch”
• “Unknown certificate” / “signature matches no certificate”
• “Expired assertion” / “not yet valid” (NotBefore, NotOnOrAfter)
• “Unexpected InResponseTo” / “unsolicited response”
• “Missing NameID” or unexpected format
• Attributes (name, groups…) are empty
• Infinite redirect loop
• The user is authenticated but “access denied”
• “Encrypted assertion” unreadable
• “Unable to decode SAMLRequest”
• “Status: RequestDenied” / “AuthnFailed”

OpenID Connect, OAuth and Entra ID

• invalid_grant: the code or refresh token is rejected
• redirect_uri_mismatch: the return address is rejected
• invalid_client: the application is not authenticated
• invalid_scope: the requested scope is rejected
• PKCE: code_verifier verification fails
• state or nonce does not match
• AADSTS50011: the reply address does not match (Entra ID)
• AADSTS700016 / AADSTS50020: the application or account does not exist in this tenant (Entra ID)
• invalid_token: the API rejects the access token
• AADSTS65001: consent is required (Entra ID)
• AADSTS50105: the user is not assigned to the application (Entra ID)
• AADSTS7000215: the client secret provided is not valid (Entra ID)

Okta, Keycloak, AD FS, Auth0, Cognito and Google

• Okta: the user is not assigned to the application (access_denied)
• Okta: the redirect_uri is not in the allowed list
• Keycloak: “Invalid parameter: redirect_uri”
• Keycloak: “Invalid client credentials” or “Client not found”
• AD FS: MSIS7042, the same session made too many sign-in requests
• AD FS: MSIS7065, no protocol handler registered
• Auth0: “Callback URL mismatch”
• Amazon Cognito: redirect_mismatch
• Google: “Error 400: redirect_uri_mismatch”

Have a message this list does not cover? Paste it into the diagnostic.