- Purpose
- Reduce SSO incidents to a repeatable diagnostic path.
- Prerequisites
- Correlation id from the failed login
- IdP sign-in logs
- Architecture
- Failures cluster into configuration, trust, mapping and policy.
Configuration
| Evidence required | Timestamp, correlation id, IdP log entry, sanitised token/assertion |
Implementation steps
- 01Confirm the request reached the IdP at all.
- 02Check signature and audience validation.
- 03Check the claim/attribute names actually present.
- 04Check conditional-access or MFA policy blocks.
- 05Reproduce in the SSO simulator with the same claim set.
Testing procedure
- Reproduce each failure class once in the sandbox so the runbook stays accurate
Troubleshooting
Loop between SP and IdP
Session cookie blocked or state mismatch; check SameSite settings.
Access denied after successful IdP login
Group/role claim missing; the user is authenticated but not authorised.