[Access Control] Troubleshooting Single Sign-On Issues

This section describes the steps to isolate the cause when an error occurs during SSO connection verification even after completing SAML SSO configuration.

1. If caused by connection settings
Please check the following on both the Access Control and SP sides.

Access Control side

In [Connected Services], confirm that the settings for the target SP are enabled.
Reference: [Access Control] Edit Connected Service

• Check whether the Access Control user accessing the SP has been granted access permission to the SP.
  Reference: SP Service Access Permission Settings
• Check that the values set for ACS URL and SP Issuer (Entity ID) exactly match the values obtained from the SP side and do not contain any unnecessary spaces or symbols.
• Check that the attribute mapping is correctly set for the attribute (NameID) required by the SP. Typically, set the Access Control attribute corresponding to the SP's login ID.
• Check that the NameID format setting (email/unspecified/persistent) matches the requirements of the SP side.
• Check that any additional attributes required for attribute settings are correctly configured.
  *Some SPs require additional attributes to be set on the IdP side. In such cases, set the values specified by the SP in "Attribute" and "Value" as needed.

SP side

• Check that the Access Control metadata (endpoint URL and certificate) is correctly registered.
  *You can check the Access Control metadata from the [Metadata] button at the top right of the Edit Connected Service screen in Access Control.
• Check that SSO settings on the SP side are "Enabled".

2. If caused by network or environment

In firewall or proxy environments, communication between Access Control, the SP, and user devices may be blocked.

• Check that communication to Access Control and the SP is allowed.
  *For information required to allow communication to Access Control, refer to the "Access Control" row in the [Network] - [Service FQDN (URL)] table in the "HENNGE One supported" Help article mentioned below.
• Check that you are not already logged in as a different Access Control user in the same browser window when accessing the SP.
  *For example, if you attempt an SSO connection test in a window where you are logged in as an Access Control admin account for SSO connection setup, it may conflict with the Access Control user linked to the SP account used for the SSO connection test, resulting in an error.
• Change the network and check if the issue can be reproduced.
• Clear the browser cache and cookies, then try again.

References:
HENNGE One supported
How to clear browser cache and use non-cache mode

If SSO behavior changes depending on the OS of the device in use, please check the following.

• Check whether the SP supports SSO from the target environment.
• Check whether login with ID and password is possible.
  *Certificate support status for Android devices and Chrome/Safari browsers on each OS may change depending on OS version or browser updates.

References:
HENNGE One supported
[Device Certificate] Restrictions when using device certificates on iOS / iPad OS

Please check the following.

1. In the Access Control Administration, check that the user's status is "Enabled".
2. Check that the target user is assigned to the correct access policy group.
3. Check that the user's account is also enabled on the SP side.
4. Check that the Access Control user ID matches the SP user ID (also check for differences in uppercase and lowercase letters).

Please check the following.

Cause 1: The target service does not support IdP Initiated

Some services do not support login via IdP Initiated. In such cases, accessing the target service from the Access Control user portal or bookmark URL may result in not being redirected to the correct screen after authentication, or SSO may fail.

Checklist

Check the service specifications to see if the target service supports IdP Initiated. If the target service only supports SP Initiated, start SSO from the service's login URL.

Cause 2: RelayState is not returned to the SP

The behavior of RelayState depends on the SSO method as follows.

Checklist

1. Check the RelayState in the Connected Service settings in the Access Control Administration.
2. If Access Control's RelayState is blank but you are not redirected to the intended screen on the SP side, check the SP's settings or specifications.