--- schema_version: "1" id: 1bfdca63e9a01c870dde3496974e4292b8be9de3a01d57081d006add7d818523 title: Troubleshooting Single Sign-On Errors collection: mulesoft version: current locale: en-us portal_url: https://docs.salesforce.com/mulesoft/current/en-us/api-experience-hub/troubleshoot-sso-errors.md canonical_url: https://docs.mulesoft.com/api-experience-hub/troubleshoot-sso-errors source_site: docs.mulesoft.com content_type: documentation content_hash: 3ee4d699d947a46ed1a5d93d742fd9d7e2251f38f8fba32b4c6cb9b2ebb9af40 description: MuleSoft Documentation Site latest: true --- --- product: API Experience Hub --- # Troubleshooting Single Sign-On Errors > For the full documentation index, see: https://docs.mulesoft.com/llms.txt The following topics provide possible causes for single sign-on (SSO) issues and describe how to troubleshoot: ## Missing Redirect URI A 400 error occurs when logging in to the portal with SSO if the external identity provider application doesn’t have the proper redirect URIs defined. To troubleshoot this issue, make sure to include necessary redirect URIs: - `https://login.salesforce.com/services/authcallback/${salesforceOrganizationId}/${authProviderURLSuffix}` - `https://${domain}.my.salesforce.com/services/authcallback/${authProviderURLSuffix}` - `https://${domain}.my.site.com/aeh/services/authcallback/${authProviderURLSuffix}` To get the following redirect URIs: - salesforceOrganizationId: In Salesforce, go to **Setup** > **Company Information**. - authProviderURLSuffix: In Salesforce, go to **Setup > Auth Providers** and select your auth provider URL Suffix. - domain: In Salesforce, go to **Setup** > **My Domain** > **Current My Domain URL**. ## Insufficient Privileges An insufficient privileges error occurs after logging in to the portal using SSO. To troubleshoot this issue, publish the portal from the Builder. 1. Navigate to **Anypoint Platform**, enter your username and password, and click **Sign in**. 2. From Anypoint Platform, select **API Experience Hub** from the list of products. 3. From the **Manage your portal** page, click **Preview and publish your portal**. 4. Click **Publish**. ## Carousel Not Loading After logging in to the portal successfully, you can’t see services in the Carousel. A few issues can cause this error to occur: - The groups claim is missing in the identity provider’s application configuration. To troubleshoot this issue, add the claim in the application and make sure at least one group is being sent. - The external identity provider group mapping is missing from Access Management. To troubleshoot this issue, add the external identity provider group mapping in Access Management for the portal member user: 1. Go to **Access Management** > **Teams**. 2. Click **AEH Portal Guests** and click **AEH Portal Members**. 3. Click **External IdP Groups**. 4. From **Group Name**, enter **AEH Members**. 5. From **Provider Name**, select the name of the corresponding Salesforce identity provider. 6. From **Type**, select **Member** and click **Add**. - The **Auth provider Default Scopes** field isn’t configured properly. To troubleshoot this issue, make sure the **Default Scopes** field has the **profile openid email groups** value. 1. In **Salesforce**, go to **Setup**. 2. In the **Quick Find** box, enter `Auth`, and then select **Auth Providers**. 3. Click **Edit**. 4. In the **Auth Provider Detail** section, enter `profile openid email groups`. 5. Click **Save**. ## Can’t Log In When logging in to the portal with an identity provider, you see a **Problem Logging In** error that the third-party identifier can’t be found. An incorrect portal URL can cause issues logging in. To troubleshoot this issue, make sure that the URL is correct in the configuration. For Okta, the `/userinfo` part of the URL path must be lowercase. ## Single Sign-On Error After logging in, **Single Sign-On Error** shows in the portal. Issues can occur if the SSO or the Salesforce Auth. Provider configuration is incorrect or missing necessary information. A few issues can cause this error to occur: - Duplicate user accounts or single sign-on errors. Users who already have an active profile in Salesforce are unable to log in via Just-In-Time (JIT) provisioned Single Sign-On (SSO). New users (those who don’t exist in the Salesforce system yet) can log in successfully, but existing users are blocked. Errors occurs because the API Experience Hub configuration is missing the specific user profiles of the users trying to log in. When the SSO attempt is made, the system doesn’t see the user’s profile as authorized for that specific API Experience Hub instance, causing the authentication process to fail for those established users. To troubleshoot this issue, follow the instructions in the Salesforce article, [API Experience Hub - Salesforce Users Unable to Log In to API Experience Hub Using JIT-Provisioned SSO](https://help.salesforce.com/s/articleView?id=005316413&type=1) to fix the issue. - The Entity ID isn’t the same in both the Salesforce Auth. Provider and the identity provider. To troubleshoot this issue for SAML protocol configurations: 1. Make sure the **Entity ID** is the same in both the Salesforce Auth. Provider’s **Single Sign-On Settings** page and the identity provider. 2. Click **SAML Assertion Validation** in the **Single Sign-On Settings** page to check for errors in the assertion. - You make changes to **Single Sign-On Settings** page without uploading the SSO certificate. To troubleshoot this issue, make sure you upload the SSO certificate each time you change the **Single Sign-On Settings** page in Salesforce. - The expected claims are missing in the identity provider’s application. After logging on using SSO, you see an SSO error with the error details in the URL. An error from the registration handler can cause this error. The most common cause is missing expected claims. To troubleshoot this issue, make sure you have the expected claims configured in the application. For more information, see [Required Claims and Attributes](https://docs.mulesoft.com/api-experience-hub/gathering-set-up-information#required-claims-and-attributes-for-sso). ## Portal Errors After logging in to the portal using SSO, you get an error in the portal. These issues can cause the error if the identity provider’s application has missing or incorrect information: - Incorrect URLs - The member isn’t assigned to a user or group in the application To troubleshoot these issues: - Review the URLs in identity provider’s application SSO configuration and the **Auth. Provider/Single Sign-On** page from Salesforce **Setup** to make sure you’re using the correct single sign-on URL. - Make sure the member is assigned to a user or a group in the identity provider application. ## Issues Testing the SSO Configuration Issues can occur when changing the SSO configuration, and then testing the configuration. To troubleshoot this issue, make sure you have a clean Salesforce and Anypoint session before testing SSO: 1. Log out of the portal, then log in again with the SSO user. This step ensures the registration handler executes properly. 2. Delete the Anypoint Platform token from the Named Credential. This step clears the Anypoint Platform user session and triggers authentication with the new configuration information to send to Anypoint Platform: 1. In Salesforce, go to **Setup**. 2. In the **Quick Find** box, enter `named credentials`, and then select **Named Credentials**. 3. Click **AEH\_Anypoint**. 4. In the **External Data User Authentications** section, locate the user you are testing with and click **Del**. ## See Also - [Known Issues](https://help.salesforce.com/s/issues)