Articles in this section

See more

Possible issues with SSO login

Catherine
  • Updated

If you're having difficulties with configuring the Miro SSO option, or your identity provider, or if one of your end-users is unable to log into Miro this article might be helpful to troubleshoot.

Miro SSO and SCIM schema can be found here.

If you're encountering an error not listed in this article please send a report to Miro Support and we will do our best to help you.

Miro error messages

Since our system does not always receive an explicit explanation from the Identity Provider system about the cause of the issue Miro messages may not show the exact reason either. 

If you cannot log in to Miro, get in touch with Miro Support

Error message

Possible reasons

 This email is not associated with an SSO account
  • The user is not a member of the account with enabled SSO and there is no pending invitation for them. Make sure that the user is invited to your account.
  • The user is not a member of the account with enabled SSO. You have Miro JIT or Domain control option enabled but the user has a previously registered profile with Miro so the options do not apply to them + there is no invitation to your account pending for them. Make sure that the user is invited to your account. 
  • The user's domain is not verified in the SSO settings.

 This email is not associated with an SSO account: Request access from your Company Admin
  • The user email that we received from the IDP differs from the one that was entered on the Miro login page and is not a member of the account with enabled SSO. This situation with mismatched emails generally happens when the IDP profile is incorrectly configured, for example when the user recently changed their email, and now the IDP and Miro are out of sync. 

Something went wrong:
Validate signature for response was unsuccessful
  • Your SAML response does not contain the required signed assertion. 
  • Your IDP treats Signed responses in a specific way. For instance, Google SSO unsigns the assertion when the response is signed. Try and unsign the response.
  • Your SAML response contains the required signed assertion but the X509 certificate value that is supposed to validate it is not present (can also happen if your VPN/firewall cuts off parts of data transfer). Please ensure that the X509 certificate value is passed in the SAML traffic to Miro. 
  • Your SAML response contains a different X509 certificate value than the one you added in your Miro settings. Check that the certificate values on the IDP side and on the Miro side match. 

Something went wrong:
User was not provided in SAML response
  • The NameID format in your SSO configuration is unspecified so the email value you send cannot be recognized. Please specify it to EmailAddress.
  • Your SAML response does not contain the email value for the user so the user cannot be recognized (can also happen if your VPN/firewall cuts off parts of data transfer). Please ensure that the email is passed in the SAML traffic to Miro. 

 Something went wrong:
SAML response
is not correct
  • The IDP user profile is configured incorrectly or is not allowed to log in by the IDP due to IP restrictions, etc.

To authorize with SSO, please use the URL link provided by
your employer
  • Your IDP is configured for IdP-initiated login only and you should not be able to sign in from the Miro sign-in page. Please log in via the provided link or reach out to your Miro account Company Admin for more information.
  • You enabled SSO in your Miro account but did not configure it. In this case, Miro assumes it's the scenario from p.1.

 Something went wrong
  • The sign-In URL is incorrect in the Miro account settings. May also redirect to and IDP error page.
  • The user’s email domain is not added to allowlist in the Company account where the invitation is pending (for instance, the user is trying to log in with a wrong email).

Users who are unable to log in to Miro via SSO can request access from Company Admins by clicking the corresponding button on the Miro SSO login page. You will need to enter the confirmation code that will be sent to your email address. Once you enter the code, a notification will be sent to Company Admins of your company's account.

Request_SSO_access.jpg
The option to request access from Company Admins for users who are unable to log in via SSO

 

Issues with logging in via SSO on tablet/mobile app

If you are unable to log in to Miro via SSO on a tablet/mobile device, please try to delete the app from the device and re-install it. If the issue persists, it is possible that this specific device cannot access the company's SSO environment. Please check with your IT department if there are any restrictions regarding specific devices which are allowed to use SSO.

 

Azure or ADFS error messages

  • - The single sign-on configuration is not available for this application in the Enterprise applications experience. Miro (formerly RealtimeBoard) is a multi-tenant application and the application is owned by another tenant.
    To change properties such as the reply URL and identifiers, contact the owner of the application.
    Most likely there is already a configured Miro app in your Azure AD where our identifier (https://miro.com/) is used and therefore taken. Azure is more or less unique in that this identity provider requires the identifier (Entity ID) to be unique.
    To possibly resolve the situation we advise you to check the Enterprise Applications of your Azure instance and use the one that you already have configured for your Miro account settings. 
    If you're sure there are no other Miro apps in your Enterprise apps, try getting a new copy of the Miro app from the Azure gallery.  

  • Below you will find some advice from the community about other specific errors:

⚠️ Please keep in mind which credentials managed by Azure/ADFS your workstation is authenticated with. If you are trying to use a different set to log into Miro the login attempt may fail, as the Identity Provider will transfer your main set of credentials and there will be a mismatch. For instance, this can happen if you are the SSO administrator and test the login procedure under different user credentials.

Azure testing tool

To get to the testing tool, choose the Single Sign-In tab in the settings of your application and scroll down to the bottom of the section.

Azure suggests using the test login process to check the connection and troubleshoot an error message. After the test, you will be given instructions on how to solve the situation.

test_page.jpg
Test page in the Azure portal/console

Google SAML errors

Please refer to this section of Google documentation that lists possible errors and instructions on how to resolve the situation. 

Was this article helpful?
Yes, thanks Not really
Sorry about that! Why wasn't the article helpful?
If you would like to get a reply from the Miro Support team, please create a ticket here
Thank you for your feedback!
Error! Please try later...
Return to top

Related articles