SSO authentication

Last update: October 05 2026Open in Markdown

First authentication

If the user was added manually, after being invited to the account, they will receive an email with an SSO login link and the federation ID.

If automatic user creation was enabled when creating the federation on the Selectel side, the link for the first authentication is provided by the Account Owner or a user with the iam_admin role.

Log in using the email link

1. In the email, click Log in with SSO.
2. Enter the federation ID.
3. Optional: to avoid entering the federation ID on every login, select the Save federation checkbox.
4. Click Log in with SSO. You will be redirected to the authorization page at the identity provider.
5. Authenticate with the identity provider. After authentication, you will be redirected back to the login page in the control panel.
6. If your full name is not specified, enter it.
7. Click Log in with SSO.

Log in via direct link

1. Follow the link provided by the Account Owner or a user with the iam_admin role.
2. If your full name is not specified, enter it.
3. Click Log in with SSO.
4. If your email is not specified, enter it.
5. If your full name is not specified, enter it.
6. Click Log in with SSO.

Authentication at each login

1. In the control panel on the login page, click Log in with SSO.
2. Enter the federation ID or select a saved federation. You can find the federation ID in the invitation email or request it from the Account Owner or a user with the iam.admin role.
3. Optional: to avoid entering the ID of the new federation on every login, select the Save federation checkbox.
4. Click Log in with SSO. You will be redirected to the authorization page at the identity provider.
5. Authenticate with the identity provider.

Authentication errors

Via SAML protocol

If SAML federation was configured incorrectly, errors may occur during federated user authentication. Error groups:

• SAML001 — SAML099 – federation configuration errors on the Selectel side;
• SAML100 — SAML199 – validation errors on the identity provider side (SAML Response);
• SAML200 — SAML299 – other errors.

Error	Cause	Resolution
SAML001 – SAML099 — configuration errors on the Selectel side
SAML001: saml_idp_is_not_configured	The SAML-compatible provider was not added on the Selectel side	Check the federation configuration on the Selectel side
SAML002: saml_idp_certs_not_configured	The federation in Selectel is missing a certificate	For the federation, add the certificate issued by the identity provider
SAML100 – SAML199 — SAML Response validation errors
SAML100: saml_response_invalid_request_id	Invalid SAML request ID. Possible causes: repeated authentication attempt within the same request (SAML Response); the time allocated for user authentication has expired — after navigating to the authentication page, the user entered credentials 10 or more minutes later	Go to the authentication page from the Selectel control panel again and log in
SAML101: saml_response_invalid_destination	The Destination parameter in the SAML Response is set incorrectly	Set the correct URL for the SAML Assertion Consumer Service on the identity provider side: in Keycloak – the Valid Redirect URIs field; for more details, see the Create a SAML federation for Keycloak instructions; in AD FS — the Relying party SAML 2.0 SSO service URL field; for more details, see the Create a SAML federation for AD FS instructions
SAML102: saml_response_invalid_in_response_to	The SAML Response was created for an authentication request with a different ID	Go to the authentication page from the Selectel control panel again and log in
SAML103: saml_response_invalid_issuer	An invalid value for the IdP Issuer field was specified when creating the federation on the Selectel side	In the federation settings in Selectel, set the correct value in the IdP Issuer field
SAML104: saml_response_invalid_signature	The signature of the received SAML Response is invalid. Possible causes: the identity provider returned an invalid SAML Response. You can check the validity of the SAML Response using third-party tools (for example, Onelogin); an invalid certificate was added for the federation in Selectel	for an invalid SAML Response: check the federation configuration on the identity provider side; for an invalid certificate: add a valid certificate
SAML105: saml_response_subject_not_found	The Subject section is missing from the received SAML Response	Configure the federation on the identity provider side so that the Subject section is included in the SAML Response
SAML106: saml_response_name_id_not_found	The NameID parameter is missing from the received SAML Response	Configure the federation on the identity provider side so that the NameID parameter is included in the SAML Response: in AD FS – configure Claims Mapping; Keycloak – no configuration required. Try authenticating again later
SAML107: saml_response_user_not_found	The user does not exist in Selectel	Add a control panel user with the login method Federation. If the user is added, make sure that the value of the ExternalID field for the created user matches the user identifier on the identity provider side
SAML108: saml_response_invalid_assertion_xml	Invalid SAML Response format. You can check the SAML Response using third-party tools (for example, Onelogin)	re-authenticate; check the federation configuration on the identity provider side
SAML109: saml_response_invalid_assertion	Invalid SAML Response	Check the federation configuration on the identity provider side. You can check the SAML Response using third-party tools (for example, Onelogin)
SAML200 – SAML299 — other errors
SAML200: saml_internal_error	To be clarified	Create a ticket
SAML201: saml_malformed_request	Invalid request parameters from the identity provider to Selectel after authentication on the provider side	Check the federation configuration on the identity provider side

Via OIDC protocol

If OIDC federation was configured incorrectly, errors may occur during federated user authentication. Error groups:

• OIDC001 — OIDC099 – federation configuration errors on the Selectel side;
• OIDC100 — OIDC199 – OIDC validation errors on the identity provider side;
• OIDC200 — OIDC299 – other errors.

Error	Cause	Resolution
OIDC001 – OIDC099 — federation configuration errors on the Selectel side
OIDC001: oidc_idp_not_configured	The OIDC-compatible provider was not added on the Selectel side	Check the federation configuration on the Selectel side
OIDC002: oidc_jwks_uri_not_configured	No JWKS URI is added to the federation in Selectel for verifying token signatures	Specify the JWKS URI in the federation settings. The JWKS URI can be obtained from the identity provider's Discovery Document, which is available at https://<idp_url>/.well-known/openid-configuration. Specify <idp_url> — your URL with the identity provider
OIDC100 – OIDC199 — OIDC validation errors on the identity provider side
OIDC100: oidc_authorization_error	The identity provider returned an error during the authorization step. Possible causes: the user rejected the authorization request; the client is not authorized for this authorization type; the requested Permitted scope is not supported; internal error on the identity provider side	Check the client settings with the identity provider and make sure that; the selected Grant Type is Authorization Code; the correct Permitted scope is specified (at least openid); the user has access to the application
OIDC101: oidc_state_mismatch	The state parameter does not match the value sent in the authentication request. Possible causes: repeated authentication attempt within the same request; the time allocated for user authentication has expired	Go to the authentication page from the Selectel control panel again and log in
OIDC102: oidc_token_request_failed	Error exchanging authorization code for tokens. Possible causes: invalid values in the Client ID or Client Secret fields; the authorization code has expired or was reused	Check the values in the Client ID and Client Secret fields in the federation settings on the Selectel side and make sure that they match the ones registered with the identity provider
OIDC103: oidc_invalid_signature	The ID Token signature is invalid. Possible causes: the identity provider returned an invalid ID Token value; an invalid JWKS URI is specified for the federation in Selectel; public key with the specified ID was not found in the JWKS	For an invalid JWKS URI: specify the correct JWKS URI in the federation settings. For key rotation: make sure that old keys are available in the JWKS during the transition period
OIDC104: oidc_invalid_token_format	Invalid ID Token format. The identity provider returned a response that does not match the JWT format	Check the federation configuration on the identity provider side
OIDC105: oidc_token_expired	The ID Token has expired	Go to the authentication page from the Selectel control panel again and log in
OIDC106: oidc_invalid_audience	The Audience (aud claim) in the ID Token does not contain the Client ID value	check the client settings with the identity provider; make sure that the token is issued for the Client ID specified in the federation settings in Selectel
OIDC107: oidc_subject_not_found	The Subject identifier (sub claim) is missing or empty in the ID Token	Configure the identity provider to include the subject identifier in the ID Token
OIDC108: oidc_nonce_mismatch	The Nonce value in the ID Token does not match the one sent in the authorization request	go to the authentication page from the Selectel control panel again and log in; check the browser cookie settings
OIDC109: oidc_user_not_found	The user does not exist in Selectel	Add a user. If the user is added, make sure that the value of the ExternalID field for the user matches the sub claim from the ID Token
OIDC200 – OIDC299 — other errors
OIDC200: oidc_internal_error	Unknown error	Create a ticket
OIDC201: oidc_malformed_response	Invalid response format from the identity provider to Selectel after authentication on the provider side	check the federation configuration on the identity provider side; make sure that the response complies with the OIDC specification