[Access Control] Troubleshooting Single Sign-On

The following is a procedure for isolating the cause when an error occurs during SSO connection verification despite completing the SAML SSO configuration.

1. When caused by connection settings
Please check the following on both the Access Control side and the SP side.

Access Control side

In ［Edit Connected Service］, confirm that the settings for the target SP are Valid.
Reference: [Access Control] Editing Service Provider Settings

• Confirm that Grant Permissions to the SP has been configured for Access Control Users accessing the SP.
  Reference: [Access Control] Creating/Editing Access Policy Groups
• Confirm that the values configured for the ACS URL and SP Issuer (Entity ID) exactly match the values obtained from the SP side and that they do not contain unnecessary spaces or symbols.
• Confirm that the Attribute (NameID) required by the SP is correctly configured in attribute mapping. Normally, configure the Access Control Attribute corresponding to the Login ID on the SP side.
• Confirm that the NameID format setting value (email/unspecified/persistent) meets the requirements on the SP side.
• Confirm that any additional Attributes required for Attribute Editor are correctly configured.
  ※Depending on the SP, it may be necessary to add Attributes on the IdP side. In this case, configure the values specified by the SP side in “Attribute” and “Value” as necessary.

SP side

• Confirm that the Access Control Metadata (endpoint URL and Certificate) has been registered correctly.
  ※Access Control Metadata can be checked from ［Metadata］ in the upper-right corner of the Edit Connected Service screen on the Access Control side.
• Confirm that the SSO setting on the SP side is “Valid.”

2. When caused by the network or environment

In firewall or proxy environments, communication between Access Control, the SP, and user devices may be blocked.

• Confirm that communication with Access Control and the SP is permitted.
  ※For information required to permit communication with Access Control, refer to “Access Control” in the table under ［Network］－［Service FQDN (URL)］ in the “HENNGE One System Requirements” help article below.
• Confirm that you are not already logged in as another Access Control User in the same browser window used to access the SP.
  ※For example, if you attempt an SSO connection test in a window where you are logged in with an Access Control administrator account to configure the SSO connection, it may conflict with the Access Control User associated with the SP-side account used for the SSO connection test, resulting in an Error.
• Change the network and confirm whether the issue can be reproduced.
• Clear the browser cache and cookies, then Retry.

Reference:
HENNGE One System Requirements
How to clear the Cache in the Browser?

If SSO behavior differs depending on the OS of the Device being used, check the following.

• Whether the SP supports SSO from the target environment
• Whether Login using an ID and Password is possible
  ※Certificate support status on Android devices and Chrome/Safari browsers on each OS may change depending on OS versions and browser updates.

Reference:
HENNGE One System Requirements
[Device Certificate] Restrictions When Using Device Certificates on iOS / iPad OS

Check the following.

1. In the Access Control Administration, confirm that the User Status is “Valid.”

2. Confirm that the target User is assigned to the correct Access policy group.

3. Confirm that the target User's account is also Valid on the SP side.

4. Confirm that the Access Control user ID and the user ID on the SP side match (also check for differences in uppercase and lowercase letters).

Please check the following.

Cause 1: The target service does not support IdP Initiated

Some services may not support the IdP Initiated login method. In this case, accessing the target service from the Access Control User Portal or a bookmark URL may prevent you from being redirected to the correct page after authentication, or SSO may fail.

Confirmation Items

Check the service specifications to determine whether the target service supports IdP Initiated. If the target service supports SP Initiated only, start SSO from the service's Login URL.

Cause 2: RelayState is not returned to the SP

RelayState operates as follows depending on the SSO method.

Confirmation Items

1. Check RelayState in Edit Connected Service in the Access Control Administration.

2. If RelayState is blank in Access Control but the SP does not redirect users to the intended page, check the SP settings or specifications.

If SSO that was previously working correctly suddenly stops working, please check the following.

1. ACS URL or SP Issuer changes due to specification changes in the connected service

The ACS URL or SP Issuer (Entity ID) Value may have changed due to an update or UI change in the connected service (SP). Check the latest SSO configuration procedure for the connected service, and Update Edit Connected Service in Access Control.

• In ［Edit Connected Service］ in the Access Control Administration, confirm that the ACS URL and SP Issuer (Entity ID) match the current values of the connected service.
• Confirm that the Access Control Metadata (endpoint URL and Certificate) registered with the connected service is up to date.

2. User information or Access policy group settings have been changed unintentionally

Confirm that User information and Access policy group settings have not been changed unintentionally.

For details, refer to the troubleshooting Procedure in ［Only specific users cannot use SSO］.