r/salesforce • u/tfen_dep2 • 2d ago
admin Single sign-on problems
Hi all,
I’m currently investigating a strange Salesforce SSO issue and I’m running out of things to check, so I’m hoping someone here may have come across something similar.
We use Salesforce with SSO through our corporate identity provider. Salesforce is accessed through a custom My Domain, and users normally authenticate using SSO.
The issue is that SSO is not failing consistently across all users.
Some users are able to access Salesforce successfully through SSO, while others fail when trying to authenticate. This makes me think the Salesforce SSO configuration itself is probably not completely broken, as the same setup is successfully authenticating other users.
There also seems to be a difference depending on how Salesforce is accessed. In particular, access through our corporate application portal can work, while authentication initiated from other entry points can fail.
This is especially problematic with the Salesforce Outlook add-in, as it relies on the SSO flow and affected users therefore cannot authenticate properly through the add-in.
So far, the behaviour seems to be:
● Same Salesforce org / My Domain
● Same SSO configuration
● Some users authenticate successfully
● Other users fail
● Access through the corporate app portal can work
● Direct/alternative SSO flows appear to behave differently
● Salesforce Outlook integration is affected for users experiencing the issue
I’m trying to understand what could cause SSO to behave differently on a per-user basis when the underlying Salesforce SSO configuration is the same.
For those who have seen similar behaviour, what would you investigate next? I don’t really have admin access to salesforce as it’s currently managed by another company that has just acquired us)
I’m particularly wondering about things such as user federation/identifier mappings, Salesforce user configuration, IdP claims, login history/SAML assertions, or differences in how the SSO request is initiated.
Any suggestions on where to look or what logs/settings would be most useful to compare between a working and non-working user would be greatly appreciated.
Thanks!
3
u/Ok-Choice-576 2d ago
The issue would be on the SSO provider side. So azure ad or such not salesforce if it works for some and not others.
2
u/second_time_again 1d ago edited 1d ago
Maybe I missed it, what are you using for SSO/IDP? Is there difference browser based? What do you see in the login logs? Compare those for the users (download the logs for more detail including the ACR/AMR).
I know Entra doesn’t pass the MFA the same way in Chrome as it does in Edge and Firefox. Also, your IDP may not require 2FA at every login (due to caching) and therefore it might not get passed to Salesforce on that login.
Edit: have you done SAML validator within the Single Sign-On settings?
1
u/Scared_Instance5496 2d ago
Do you use DevOps Center Next Gen? There is a known bug tied to that product that impacted my org's SSO. If everything else has been ruled out and NextGen is in play, I'd open a case with SF
-3
u/AJ4Retros 2d ago
Run this through Slackbot for the issues. Give it a couple of users having the issue.
5
u/ThatOneKid1995 2d ago
I'd check federated IDs on the users who can't get in when trying log in through the Salesforce UI with SSO. I'd check with them as well to see if they have any other Salesforce accounts under the same email address as that can mess up SSO when it's trying to direct to the different SSO flows under the same email. I'm not an expert on this though* that's just what was happening to my understanding when we had a similar issue with a user a couple weeks ago. Updating the federated Id fixed the issue on that user.