Skip to content
NameDrop Documentation

SSO troubleshooting

My SSO login isn’t working

Section titled “My SSO login isn’t working”

SSO setup is hands-on for now — NameDrop’s team can help debug. A quick Zoom call is often the fastest path because we can watch the SAML assertion together and spot the mismatch live.

To get started:

  1. Note down what you see when SSO fails — the exact error message, screenshot if possible.
  2. Email hello@namedrop.io with:
    • Your organization name
    • Your IdP (Okta, Azure AD, Google Workspace, etc.)
    • The error you’re seeing
  3. We’ll schedule a short call with your IdP admin to step through the assertion.

Common causes

Section titled “Common causes”
  • Attribute mapping mismatch — NameDrop expects email, firstName, lastName (at minimum). See SAML setup for the standard SAML attribute names we map to.
  • Signing certificate mismatch — the IdP signing cert on file in Cognito doesn’t match what your IdP is currently signing with (this happens after IdP cert rotation).
  • Entity ID typo — the Entity ID NameDrop has in Cognito doesn’t exactly match what your IdP is sending.

Most of these are 5-minute fixes once we’re looking at the assertion together.

Reading the error message

Section titled “Reading the error message”

When sign-in fails, you’re usually redirected back to https://user.namedrop.io/login with an error_description parameter in the address bar. That text is the fastest way to localize the problem — copy the whole URL and send it to us.

Each message means something specific, and they get progressively “deeper” into the sign-in process, so they’re a useful sense of how close you are:

error_description containsWhat it meansFix
Invalid relayState from identity providerThe request never got past the front door. Either IdP-initiated sign-in isn’t enabled for your connection yet, or the RelayState value is missing, malformed, or is a URL instead of the parameter string.Confirm with us that it’s enabled, then re-check RelayState against the setup guide. Try the URL-encoded form.
Response from SAML IdP contains an invalid signatureYour assertion arrived and was read, but couldn’t be verified. Almost always the identity_provider= value in your RelayState names a different connection than the one that signed the assertion — or your IdP rotated its signing certificate.Check identity_provider= matches the provider ID we gave you. If it does, send us your current IdP metadata so we can refresh the certificate.
Responses must contain exactly one AssertionThe POST reached us but the SAML document was empty or malformed.Usually an IdP-side template or binding problem. Check you’re sending HTTP-POST, not HTTP-Artifact.
no error — you land on /login?code=...Success.—
Section titled “Related”