Hi everyone, I'm hoping someone can point me in the right direction. I'm setting up a new SSO integration between our PingFederate instance and Salesforce (using the Salesforce connector template).
The federation is established, but Salesforce is rejecting our SAML responses. The error in the Salesforce logs is pretty generic: "SAML Assertion Consumer Service failed to validate SAML Response."
From my side in the PingFederate logs, I see the response is being sent successfully. I've double-checked the obvious:
- The Entity ID and ACS URL in Ping match Salesforce's configuration.
- The NameID format is set to "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress".
- Our signing certificate is uploaded in Salesforce and hasn't expired.
I'm wondering if the issue might be with the attribute mapping? Or perhaps a clock skew problem? What are the most common pitfalls when the config seems right but the handshake still fails? Any specific logs or settings in Ping I should be looking at more closely?
Thanks in advance!