Salesforce Troubleshooting

Common issues and how to fix them.

Federation ID not found

Salesforce can't match the assertion to a user. Make sure the persona's Federation ID in IdP Simulator exactly matches the Federation ID field on the Salesforce user, and that the SAML Identity Type is set to "Federation ID from the User object."

Invalid signature

The certificate Salesforce has doesn't match the one your realm is signing with. Re-download the certificate from your realm's SAML tab and upload it again in Salesforce's SSO settings.

Audience mismatch

The Entity ID configured in IdP Simulator doesn't match the Service Provider Entity ID in Salesforce. They must be identical, typically https://<your-domain>.my.salesforce.com.

Login loops or blank page

Usually means the ACS URL is wrong. Double-check that the ACS URL in IdP Simulator matches what Salesforce expects, including the ?so=<org-id> parameter.

SSO option not showing on Salesforce login page

SAML might not be enabled, or the SSO configuration isn't assigned to a login page. In Salesforce, go to Setup → My Domain → Authentication Configuration and make sure your SSO config is listed under the login page.