Articles in this section

Possible Issues with SSO

Cath Elle
  • Updated

If you're having difficulties with configuring your identity provider or one of your end-users is unable to log into Miro this article might be helpful to troubleshoot.

Miro Error Messages

Since our system rarely receives an explicit explanation from the Identity Provider system about the cause of the issue Miro messages do not show the exact reason either. We do however strive to update the information transfer process and make our messages clearer.

Error message

Possible reasons

 This email account is not associated with an SSO account
  1.  IdP user profile is configured incorrectly (emails do not match).
  2.  You have Miro JIT option enabled but the Miro profile is already registered so JIT does not apply to them. At the same time, the user does not have an invitation to the team pending for them. Make sure that the user is invited. If the user is not supposed to be a part of the team, they should continue using the standard authorization methods. 

 Something went wrong
  1.  IdP certificate and Miro account certificate do not match.
  2.  Sign-In URL is incorrect in the Miro account settings. May also redirect to IdP error page.
  3.  The user’s email domain is not whitelisted with the Company where the invitation is pending (for instance, the user is trying to log in with a wrong email).

 Something went wrong:
SAML response
is not correct

   IdP user profile is configured incorrectly or is not allowed to log in by the IdP
     due to IP restrictions, etc.

Something went wrong:
Validate signature for response was unsuccessful
  1.  Your IdP treats Signed responses in a specific way. For instance, Google SSO
         unsigns the assertion (which we require to be signed) when the response
         is signed. Try and unsign the response.
  2. The NameID in your SSO configuration is unspecified. Please set it to Email format.

To authorize with SSO, please use the URL link provided by your employer

   Your IdP is configured for IdP-initiated login only and you should not be able
   to sign in from the Miro sign-in page. Please log in via the provided link or 
   reach out to your Miro account admin for more information. 

 

Azure or ADFS Error messages

Below you will find some advice from the community about specific errors:

“An error occurred. Contact your administrator for more information.” - community user case example

"Role not assigned" error - community article

Other possible errors - support.microsoft.com article

⚠️ Please be aware of which email address is transferred from the Identity Provider to Miro.
For instance, if your work station is authenticated with one set of credentials managed by Azure/ADFS but you are trying to use a different set to log into Miro the login attempt will fail, as the Identity Provider will transfer your main set of credentials and there will be a mismatch. This can also happen in the situation where your SSO administrator tests the login procedure under different user credentials. 

Azure testing tool

To get to the testing tool, choose the Single Sign-In tab in the settings of your application and scroll down to the bottom of the section.

Azure suggests using the test login process to check the connection and troubleshoot an error message. After the test, you will be given instructions on how to solve the situation.

mceclip0.png

Test page in the Azure portal/console

If you have any further questions send us a message at support@miro.com and we will do our best to help you.

Google SAML errors

Please refer to this section of Google documentation that lists possible errors and instructions on how to resolve the situation. 

Related articles