SSO authentication

Last update: April 16 2025

SSO authentication

First authentication⁠

Once invited to the account, the federated user will receive an email with a link to authorize by SSO and federation ID.

1. In the email, click SSO login.
2. Enter the federation ID.
3. Optional: to avoid entering the federation ID each time you log in, check the checkbox Preserve the federation.
4. Click Sign in.
5. You will be redirected to the authorization page at the credential provider. After authorization, you will be returned to the Control Panel login page.
6. Enter full name.
7. Click Sign in.

Authentication at every login⁠

1. in control panels on the login page, click Log in with SSO.
2. Enter the federation ID or select a saved federation. The federation ID can be seen in the invitation letter or requested from the User Administrator.
3. Optional: to avoid entering the ID of a new federation every time you log in, check the checkbox Preserve the federation.
4. Click Sign in. You will be redirected to the authorization page at the credential provider.
5. Authorize with the credentialing vendor.

Authentication errors⁠

If federation has not been configured correctly, errors may occur when authenticating a federated user. Error Groups:

• SAML001 — SAML099 — federation configuration errors on the Selectel side;
• SAML100 — SAML199 — validation errors on the credential provider side (SAML Response);
• SAML200 — SAML299 — other errors.

Error	Reason	Decision
SAML001 — SAML099 — configuration errors on Selectel side
SAML001: saml_idp_is_not_configured	SAML-compliant IdP has not been configured on the Selectel side	Check it out federation setup on the Selectel side
SAML002: saml_idp_certs_not_configured	The federation in Selectel does not have a certificate	For the federation add certificate issued from a credential vendor
SAML100 — SAML199 — SAML Response validation errors
SAML100: saml_response_invalid_request_id	Incorrect SAML request identifier. Possible causes: repeated authentication attempt within a single request (SAML Response); the time allotted for user authentication has expired — after going to the authentication page, it took 10 minutes or more for the user to enter credentials	Go to the authentication page from the Selectel control panel and authorize again
SAML101: saml_response_invalid_destination	Parameter Destination is not set correctly in SAML Response	Expose the correct URL for SAML Assertion Consumer Service on the credential provider side: in Keycloak is a parameter Valid Redirect URIs, see instructions for details Configure federation on the Keycloak side; in AD FS is a parameter Relying party SAML 2.0 SSO service URL, see instructions for details Configure federation on the Active Directory Federation Services side
SAML102: saml_response_invalid_in_response_to	SAML Response was created for an authentication request with a different identifier	Go to the authentication page from the Selectel control panel and authorize again
SAML103: saml_response_invalid_issuer	At federation Selectel has an invalid value for the field IdP Issuer	In the federation settings in Selectel, set the correct value in the field IdP Issuer
SAML104: saml_response_invalid_signature	The signature of the received SAML Response is set incorrectly. Possible causes: the credential provider returned an incorrect SAML Response. You can check if the SAML Response is correct using third-party utilities (for example, Onelogin); an invalid certificate has been added to Selectel for the federation	When an incorrect SAML Response: Check the federation configuration on the credential provider side; with an invalid certificate: add a valid certificate
SAML105: saml_response_subject_not_found	Section Subject is missing from the received SAML Response	Configure federation on the credential provider side so that the SAML Response includes the section Subject
SAML106: saml_response_name_id_not_found	NameID is missing from the received SAML Response	Configure federation on the credential provider side so that SAML Response includes the parameter NameID: in AD FS — customize Claims Mapping; Keycloak — No settings are required. Authenticate again later.
SAML107: saml_response_user_not_found	User does not exist in Selectel	Add a federated user. If a federated user is added, make sure that the value of the field ExternalID of the created federated user corresponds to the user ID on the credential provider side.
SAML108: saml_response_invalid_assertion_xml	Incorrect SAML Response format. You can check SAML Response using third-party utilities (for example, Onelogin)	Re-authentication; check Configuring federation on the credential provider side
SAML109: saml_response_invalid_assertion	Incorrect SAML Response	Check it out Configuring federation on the credential provider side. You can check SAML Response using third-party utilities (e.g., Onelogin)
SAML200 — SAML299 — other errors
SAML200: saml_internal_error	Requires clarification	Create a ticket help desk
SAML201: saml_malformed_request	Incorrect request parameters from credential provider to Selectel after authentication on the provider side	Check it out Configuring federation on the credential provider side