jackson: SSO login is not working
Found a bug? Please fill out the sections below. 👍
Issue Summary
A summary of the issue. This needs to be a clear detailed-rich summary.
We tried creating SAML app in google admin and followed the steps as described in the tutorial https://boxyhq.com/docs/jackson/sso-providers/google
and created a SAML connection with the rawMetadata from the xml file downloaded from google SAML app.
When we try using the SSO login, after email and password is entered the google error page is shown as below
Error: app_not_configured_for_user
Service is not configured for this user.
Request Details
idpid=xxxxxxxxxx
RelayState=boxyhq_jackson_xxxxxxxxxxxxx
SAMLRequest=xxxxxxxxxxxxxxx
The error from the SSO tracer is
Invalid assertion. invalid signature: the signature value xxxxxxxxxxxxxxxxx is incorrect
Assertion Type: Response
SP Protocol: OAUTH 2.0
Steps to Reproduce
- Followed the steps as described in the tutorial https://boxyhq.com/docs/jackson/sso-providers/google
- Created a SAML connection with the
rawMetadatafrom the xml file downloaded from google SAML app.
Any other relevant information. For example, why do you consider this a bug and what did you expect to happen instead?
Technical details
- Browser version: You can use https://www.whatsmybrowser.org/ to find this out. Chrome 123
- Node.js version: 18
- Anything else that you think could be an issue.
About this issue
- Original URL
- State: closed
- Created 3 months ago
- Reactions: 1
- Comments: 15 (8 by maintainers)
@deepakprabhakara and @niwsa Thank you very much for releasing the fix quickly, it is working now.
You’re most welcome. Thanks for reporting it.
If you can send Aswin (to the email above) the SAML response we can investigate.
@thekoushik Would be happy to look into the issue over a call if you are up for it. You can ping me at aswin@boxyhq.com.
app_not_configured_for_userfrom Google would indicate that the user has not been provisioned in Google to access the SAML app. The SSO tracer trace might be for a different login, that would normally indicate a signature mismatch. Is it from the same tenant and product as the Google connection?