Tags | SAML | Authentication | Troubleshooting |

ADMIN PRIVILEGES REQUIRED

This documentation is for Stack Overflow for Teams Enterprise. Free, Basic, and Business users can access their documentation here. Find your plan.

Properly configuring Security Assertion Markup Language (SAML) authentication with an identity provider (IdP) can be tricky. To make configuration easier, Stack Overflow for Teams Enterprise (SOE) provides several means to troubleshoot SAML authentication problems.

To start troubleshooting SAML configuration problems, log in to SOE as an administrator and click Admin settings in the left-hand menu. Click Authentication.

You can enable database logging of both successful and unsuccessful SAML authentication responses for quicker troubleshooting. To enable this feature, check Enable SAML Response logging for troubleshooting and click Save settings.

Site admins can then view the stored logs on one of the following developer log pages:

Clicking the Test currently saved SAML configuration button initiates an authentication request to your SAML identity provider and displays the response. You can also go directly to the SAML test page at https://[your_site].stackenterprise.co/enterprise/support/saml-login.

The SAML test page consists of the following four sections.

Base64-encoded SAML response
This shows the raw (Base64-encoded) data, exactly as received from the IdP. If you're requesting help with your SAML setup, include this raw data with the help ticket as an attachment or pasted text.

Successfully parsed SAML Response to XML
This shows the data as parsed in XML format.

Authentication log
This shows a log of the authentication process, including the processing access rules. You'll find a wealth of useful troubleshooting info in this section.

All Attributes in Assertion
This shows the final product of a successful SAML login: the attributes (user data) returned from the IdP.

Some IdPs update certificates every hour, providing a link for SOE to download the refreshed certificates automatically. If this process fails, use the Parse SAML 2.0 EntityDescriptor from Identity Provider (IdP) link at the bottom of your site's SAML 2.0 settings page to troubleshoot the problem.

Enter the URL from the Update certificates from federation metadata URL field to test the full download process. If the URL is working but the resulting file is failing, paste the contents of the downloaded FederationMetadata.xml file into the EntityDescriptor XML box and click Parse from XML.

SOE will parse the XML file and display the relevant data, including the authentication request (SSO) URL and signing certificate (public key). Verify these values against your SAML settings.

A properly formed FederationMetadata.xml file should look like this:

If you're having problems after following the steps above, reach out to support for help.