---
schema_version: "1"
id: 182f84710976f07b3de5d8c8c139ad50522278460bd425245324592d3848f9ac
title: Troubleshoot Login Issues with Salesforce Identity for Enablement
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/sales/264-0-0/mth_sifm_troubleshoot.md
canonical_url: https://help.salesforce.com/s/articleView?id=sales.mth_sifm_troubleshoot.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 2ea1ace8ea984f70c1ee27245f022e04ceb35116f54bb22ac3ba01256cc91811
description: If you configure your enablement site to use Salesforce Identity for Enablement authentication, users can sometimes encounter issues when they try to log in. Help resolve any issues your users encounter when they visit your site’s login URL and enter the credentials.
products:
  - Sales Cloud
  - Sales Enablement
release: "264"
---
# Troubleshoot Login Issues with Salesforce Identity for Enablement

If you configure your enablement site to use Salesforce Identity for Enablement authentication, users can sometimes encounter issues when they try to log in. Help resolve any issues your users encounter when they visit your site’s login URL and enter the credentials.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition"><colgroup><col></colgroup><tbody><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: <strong>Enterprise</strong>, <strong>Performance</strong>, and <strong>Unlimited</strong> Editions</td></tr></tbody></table>

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small permission">
      <colgroup>
        <col style="width:50%">
        <col style="width:50%">
      </colgroup>
      <thead class="slds-text-title_caps ">
        <tr class="">
          <th scope="colgroup" class="slds-cell-wrap" colspan="2" style="text-align:center;vertical-align:top;" id="d17085e61">User Roles</th>
        </tr>
      </thead>
      <tbody>
        <tr class="">
          <td data-label="User Roles" class="slds-cell-wrap" style="vertical-align:top;" headers="d17085e61 ">This topic supports these enablement site roles:</td>

          <td class="slds-cell-wrap" style="vertical-align:top;" headers="d17085e61 ">Salesforce Admins</td>

        </tr>
      </tbody>
    </table>

## Incorrect Salesforce Identity for Enablement Setup

If you know that you entered an incorrect login URL, connected app Consumer Secret, or connected app Consumer Key when you [configured Salesforce Identity for Enablement](https://help.salesforce.com/s/articleView?id=sales.mth_configure_mytrailhead_identity.htm&release=264.0.0&type=5 "To set up Salesforce Identity for Enablement for your enablement site, first create a connected app in Salesforce. The connected app handles data sharing between your enablement site and Salesforce using OpenID Connect and OAuth 2.0—protocols that authenticate users and authorize access to data in your org. Finally, enter your connected app details on your enablement site."), submit a Salesforce Customer Support case. Provide the corrected details that you want to use for updating your enablement site’s configuration.

## Infinite Redirect after Logging In

If a user is caught in an endless redirect loop after logging in, the login URL references the trailhead domain instead of the salesforce domain. For example, the specified login URL is https://subdomain.my.trailhead.com instead of https://subdomain.my.salesforce.com.

To fix the login URL to use the correct domain, submit a Salesforce Customer Support case.

## Redirect URI Mismatch

If a user sees a mostly blank page with only the error message redirect\_uri\_mismatch or similar after logging in, the connected app’s callback URL is incorrect.

To fix the callback URL:

1. Create another connected app in your org, and be sure to specify the correct callback URL.
2. Submit a Salesforce Customer Support case. Request an update to your enablement site’s Salesforce Identity for Enablement configuration so that it uses the Consumer Secret and Consumer Key values from your new connected app.
    
    ![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-sales-mytrailhead-264-0-0-production-enus/0d6bc03d-58c7-47e8-89c9-5e00c98b5485/images/icon_note.png)
    
    Note Updating your previous connected app with new values doesn’t necessarily solve this issue.

This error can also appear if your org’s list of allowed IP addresses excludes the Sales Enablement outbound IP addresses. Try adding the list of enablement site outbound IP addresses to the org’s allowed addresses. To learn more, check out the Salesforce Knowledge article, [Salesforce IP Addresses and Domains to Allow](https://help.salesforce.com/s/articleView?id=000321501&type=1&language=en_US).

## Redirect to Trailhead

If a user navigates to Trailhead instead of your enablement site after logging in, no error appears. But the user most likely doesn’t have the correct permissions to access your enablement site.

To resolve this issue, add the user to a permission set that meets these criteria:

- Uses the Enablement Sites (myTrailhead) permission set license.
- Enables access to at least one content collection.

For more information, check out [Allow Learners to Access Enablement Site Content Collections](https://help.salesforce.com/s/articleView?id=sales.mth_content_permissions.htm&release=264.0.0&type=5 "Ensure that learners can access only the trails and modules that are relevant to their disciplines or job requirements. Create content collections for your different audiences, and then use permission sets to enable access to specific content collections. Only learners with permission to access a particular content collection can view and complete the trails and modules included in the collection.").

## 403 Error

If a user encounters a 403 error code after logging in, a security setting in your org is preventing the user from successfully receiving an OAuth token. This error can occur even when the user entered the correct credentials.

To verify the specific cause, copy the error message shown on the page into a search engine. Some known error messages that can cause this issue include:

IP allowlist violation

The user is logging in from an IP address that’s outside of the org’s allowed addresses. To resolve this issue:

1. Verify whether the user can log in from your enablement site’s login URL through a web browser. If they still can’t log in through a browser, continue to the next step.
2. Add the list of enablement site outbound IP addresses to the org’s allowed addresses. To learn more, check out the Salesforce Knowledge article, [Salesforce IP Addresses and Domains to Allow](https://help.salesforce.com/s/articleView?id=000321501&type=1&language=en_US).

User isn’t admin-approved to access this app

The user doesn’t belong to a profile or permission set that the connected app authorizes.

To resolve this issue, add the user to a profile or permission set that you selected from the Permitted Users dropdown in the connected app’s OAuth access policies.

If you’re certain that the connected app is configured correctly but users are seeing this error, complete these steps:

1. Create another connected app in your org.
2. Submit a Salesforce Customer Support case. Request an update to your site’s Salesforce Identity for Enablement configuration so that it uses the Consumer Secret and Consumer Key values from your new connected app.

## Invalid Page with an Experience Cloud Site

If your enablement site’s login URL is an Experience Cloud site URL and a user receives an invalid page error after logging in, there’s likely an incomplete SSL certificate chain.

To confirm that an incomplete SSL certificate chain is the cause of the issue, analyze your Experience Cloud site URL at [SSL Labs](https://www.ssllabs.com/ssltest).

To resolve this issue:

1. Generate the missing intermediate certificates at [https://whatsmychaincert.com](https://whatsmychaincert.com), and download the .crt files locally.
2. In Salesforce, from Setup, enter certificate in the Quick Find box, and then select **Certificate and Key Management**.
3. Upload the .crt files.

#### See Also

- [Configure Salesforce Identity for Enablement](https://help.salesforce.com/s/articleView?id=sales.mth_configure_mytrailhead_identity.htm&release=264.0.0&type=5 "To set up Salesforce Identity for Enablement for your enablement site, first create a connected app in Salesforce. The connected app handles data sharing between your enablement site and Salesforce using OpenID Connect and OAuth 2.0—protocols that authenticate users and authorize access to data in your org. Finally, enter your connected app details on your enablement site.")
- [Allow Learners to Access Enablement Site Content Collections](https://help.salesforce.com/s/articleView?id=sales.mth_content_permissions.htm&release=264.0.0&type=5 "Ensure that learners can access only the trails and modules that are relevant to their disciplines or job requirements. Create content collections for your different audiences, and then use permission sets to enable access to specific content collections. Only learners with permission to access a particular content collection can view and complete the trails and modules included in the collection.")
- [_Salesforce Knowledge:_ Salesforce IP Addresses and Domains to Allow](https://help.salesforce.com/s/articleView?id=000321501&type=1&language=en_US)
- [_Website:_ SSL Labs](https://www.ssllabs.com/ssltest)
- [_Website:_ What's My Chain Cert?](https://whatsmychaincert.com)