Error: We're Unable to Process the SSO Request

Issue

When you test your PingOne SAML single sign-on (SSO) configuration, the following error appears:

We're unable to process the SSO request. Update your SP configuration to send the AuthnRequest to /sso/idp/SSO.saml2?idpid=<idpid>

Environment

• Identity provider: PingOne
• Authentication method: SAML SSO

Resolution

To resolve this issue, update the Sign on URL in Fivetran to use the PingOne Single Signon Service URL:

1. In the PingOne Admin console, open the Fivetran app page.
2. Select the Configuration tab.
3. Copy the Single Signon Service URL. It uses the format <base_url>/sso/idp/SSO.saml2?idpid=<idpid>.
4. In Fivetran, click Account Settings > General.
5. Under SAML Config, replace the value in the Sign on URL field with the Single Signon Service URL.
6. Click Save Config.
7. Test your SSO configuration again.

For more information, see the Get Sign on URL, Issuer, Public certificate, and Application Identifier step of our PingOne SAML SSO setup guide.

Cause

This issue occurs when the Sign on URL field in Fivetran doesn't contain the PingOne Single Signon Service URL. For example, you may have entered the Initiate Single Sign-On URL, which contains /sso/sp/initsso.

Fivetran uses a service provider-initiated SAML flow. We send authentication requests, called AuthnRequests, to the URL in the Sign on URL field. PingOne accepts these requests only at the Single Signon Service endpoint. The Initiate Single Sign-On URL is only for identity provider-initiated sign-in, so PingOne rejects requests sent to it.