AuthTrace › Guides
Sign-in troubleshooting guides
Each guide starts from the error message a user or an application shows, explains which two values disagree, and says exactly where to change them. Written for the admin who owns the identity provider and the engineer who owns the app.
Fix a SAML audience mismatch
What "AudienceRestriction not satisfied" means, how to find the two values that disagree, and where to change them in the IdP.
SAMLDecode a SAMLResponse
Base64, DEFLATE and the two bindings - how to read a SAML message by hand, and which fields matter when sign-in breaks.
SAMLFix an InResponseTo mismatch
The app says the response doesn't match its request, or calls it unsolicited. Usually a lost session cookie - here is how to prove it.
SAMLAssertion not yet valid, or expired
NotBefore, NotOnOrAfter and clock skew - how to tell a drifting server from a time-zone bug or a replayed response.
SAMLSignature validation failed
Usually a rolled-over signing certificate. How to compare fingerprints, and the four other reasons a valid-looking signature is refused.
ENTRAFix AADSTS50011 / redirect_uri mismatch
The redirect URI or reply URL the app sent is not registered. Find the exact value, spot the difference, and register it in the right place.
OAUTHFix invalid_grant
The code-for-token swap fails. Usually the code was redeemed twice or the PKCE verifier doesn't match - how to tell which.