When implementing and using single sign-on, you may encounter various error messages. You'll find common error messages in this article and how to resolve them. If you encounter different errors or have issues resolving these, please contact us.
- Required String parameter 'RelayState' is not present
- SAML assertion signature is invalid
- Your account is either inactive or does not exist in Elite
- Invalid SAML response received. Invalid user attributes: email. The attribute ‘email’ is required.
Required String parameter 'RelayState' is not present
Elite does not support IdP initiated SSO requests. You will need to initiate your login requests from Elite itself. If you are using MyApps to sign into Elite, you will encounter this error. To resolve this issue, please ensure that you either login via the Elite portal or capture your Elite SP login url.
SAML assertion signature is invalid
Ensure that your Identity Provider's metadata is up to date. If you previously manually uploaded a metadata file into Elite, please ensure that the certificate used in that metadata is up to date. You may need to reupload your IdP's metadata.
Your account is either inactive or does not exist in Elite
If you see this error do a check for the following:
- Does the user attempting to login exist within Elite?
- Does the user's email within Elite match their actual email address?
- Can you confirm that the Enterprise Application (AAD)/App Integration (Okta) SAML email attribute is accurately mapping the user's email?
- Clear your browser's cookies and cache as you may be signing in via an alternate cached identity.
Please contact us if the issue persists.
Invalid SAML response received. Invalid user attributes: email. The attribute ‘email’ is required.
The email address used in the SSO authentication (the "email claim" from your Identity Provider) must match the email address stored for the user in Momentus Elite. If the email claim does not match, the user will not be able to log in via SSO, even if all other configuration steps are correct. If you see this error, check your settings:
- Go into your Identity Provider (IDP) and find the application settings configured for Momentus Elite (the Service Provider).
- Update the Claim. Check the user attributes or "claims" being sent to Momentus Elite.
- Set the Email Claim. The Name ID (or email claim) must be explicitly set to use the following exact URI:
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress. This URI ensures that when your system sends us the user's login information, it uses the email address as the unique identifier that Elite expects.