Resolve Federated ID (SSO) sign-in errors

After successfully configuring SSO within the Adobe Admin Console, ensure that you select Download Adobe Metadata file and save the SAML XML Metadata file to your computer. Your identity provider requires this file to enable single sign-on. Import the XML configuration details properly into your identity provider (IdP). This is required for SAML integration with your IdP and will make sure that the data is configured properly.

If you have questions as to how to use the SAML XML Metadata file to configure your IdP, reach out to your IdP directly for instructions, which vary per IdP.

Basic troubleshooting

Solutions to other common errors

Error: "An error occurred" with button labeled "Try Again"

Error: "Access Denied" while signing in

Error: "Another user is currently logged in"

The error "another user is currently logged in" occurs when the attributes sent in the SAML assertion don't match the email address that was used to start the login process.

Run a SAML trace and ensure that the user's email address to log in matches the following:

• User's email address listed in the Admin Console
• User's username passed back in the NameID field of the SAML Assertion
  

Error: "The Issuer in the SAML response did not match the issuer configured for the identity provider"

IDP Issuer in the SAML Assertion is different from what has been configured in the Inbound SAML. Look for typos (such as http vs https). When checking the IDP Issuer string with the customer SAML system, you're looking for an EXACT match to the string they provided. This issue comes up sometimes because a slash was missing at the end.​​

If you need assistance with this error, provide a SAML trace and values you entered in the Adobe dashboard.

Error: "The digital signature in the SAML response did not validate with the identity provider's certificate"

Error: "The current time is before the time-range specified in the assertion conditions"

UNIX-based IdP Server

Ensure that the system clock is set correctly either using the ntpd service, or manually with the ntpdate command from a root shell or with sudo as shown below (note that if the time is offset by more than 0.5 seconds, the change will not happen immediately, but it will slowly correct the system clock). Ensure that the timezone is also set correctly.

# ntpdate -u pool.ntp.org

Error: 401 unauthorized credentials

Error: "Inbound SAML login failed with message: The SAML response contained no assertions"

​Check the login workflow.  If you're able to access the sign-in page on another machine or network but not internally, the problem could be a block agent string.  Also, run a SAML trace and confirm that ​​First Name, Last Name, and Username as a properly formatted email address​​​​ are in the SAML subject.

Error: "400 bad request" or "The status of the SAML request was not successful" or "SAML certification validation failed"

Error: "403 malfunctioned certificate"

Update the certificate in Google Console under the Adobe SAML app and re-upload the metadata files in the Adobe Admin Console.

Error: "403 app_not_configured_for_user"

Update Entity ID in the Google Console. Then export the metadata file and upload it in the Adobe Admin Console.

Error: "you cannot access this right now" or "you can't get there from here"

This error generally occurs when the organization has enabled the Conditional Access Policy in IdP.

If you are using managed packages to deploy products, create a managed package from the Adobe Admin Console by selecting the browser-based authentication option. Then, deploy it on the user's device.

If not, the users can open the Creative Cloud Desktop application, and select Sign in using your browser from the Help menu.

Error: "App Not Assigned"

In this case, the admin must add the users to the Adobe SAML app created on their IdP. Learn to create an Adobe SAML app on Google Admin console or Microsoft Azure Portal.

Error: "You do not have access to this service. Contact your IT administrator to gain access or sign in with an Adobe ID"

Check the SAML logs, as the username or email address being sent in the SAML assertion does not match the information entered in the Admin Console.