Skip to content

Menu AuthGuardHelp centre

Troubleshooting · SAML

SAML application sign-in errors (invalid request, certificate, keys)

1 min read
SaaS · Self-hosted

What does the user see?

«This sign-in request expired or belongs to another browser. Start again from the application.»: go back to the application and start again, in the same browser.
«The SAML request could not be validated.»: the application sent a request that does not match its configuration. Contact your administrator.
The application shows its own error after sign-in: usually a certificate or attribute problem on the application's side.

Causes for the administrator

Situation	Likely cause	What to do
«The SAML request could not be validated.»	Entity ID or ACS address differ from the registered ones; a request signed with a certificate that is not registered	Compare the values with the application's metadata
The application refuses the response	The application lacks the current signing certificate, or expects a signed response while only the assertion is signed	Download the certificate with «Download certificate (PEM)» and review «Signed»
NameID or unknown user error	The NameID format or the email attribute is not what the application expects	Adjust the format and attributes
Time error ("not yet valid", "expired")	The application server's clock is wrong	Fix the application server's NTP
`409 saml_keys_not_configured`	The organization has no SAML signing key yet; there is no metadata	On self-hosted, the operator adds the key; on the shared service, contact your provider
Certificate expiring warning	The certificate expires within 60 days	Add the next one and update every application

When to escalate

If the metadata, the certificate and the time are right and the application still refuses, collect the application's error log and contact support with the Entity ID and the time.

Error codes in this article

Article referencets-saml-errorsquote it to support to identify this article. Checked against the product at commit 5f6607a8.