Troubleshooting

This page is not available in the language you requested. You have been redirected to the English version of the page.
Link to this page copied to clipboard

Common SSO problems and their resolutions

Not for use with personal data

The location of the error indicates which side to check. An error on your sign-in page indicates a problem with your identity provider configuration. An error on Deque's sign-in page indicates a problem with the Deque connection. Capture a screenshot and send it to helpdesk@deque.com.

Common Problems

Symptom Likely cause Resolution
All users stop signing in suddenly Your signing certificate expired or was rotated Send Deque your current signing certificate
The user is returned to the login page repeatedly The Name ID does not match the user's Deque email address, often a username or a different domain Confirm the Name ID maps to the user's work email address, and check for differences in capitalization
"Link expired", or the assertion is rejected Entity ID mismatch Compare both values character for character, including trailing slashes
An error appears immediately after selecting the application tile An incorrect Entity ID or reply URL Confirm you used the value ending in /clients/<client name> rather than the one ending at /endpoint. In Entra ID, confirm there is exactly one reply URL
Users are asked to enter their name on first sign-in Name attributes are missing or misnamed, or the attribute name format is incorrect Check the attribute names and confirm the format matches your provider
Signature validation fails An incorrect certificate, or a deprecated signing algorithm Confirm Deque has your current certificate, and use rsa-sha256 with the sha256 digest rather than SHA-1
Only some users can sign in Users are not assigned to the application Assign the relevant users or groups in your identity provider
The user reaches the Deque login screen instead of the product The SP-initiated flow was triggered where IdP-initiated was expected Confirm the application is configured for IdP-initiated login and that the user started from your portal
The user signs in but has no product access Authentication succeeded, but entitlement is separate Assign a product seat in the axe Account Portal or through SCIM
A user on a subdomain cannot sign in Subdomains require their own connection Ask Deque to add a connection for that subdomain

The linking email must reach the user. Confirm the following:

  1. The address is a deliverable mailbox rather than a forward-only or cosmetic address.
  2. Email from Deque is not being filtered or quarantined.
  3. The user has not changed the email address on the profile page shown after their first SSO sign-in.

Before Contacting Support

Providing the following information resolves cases considerably faster:

  • The product and URL the user started from
  • The affected user's email address, and whether their Deque account is new or existing
  • Whether the problem affects all users on the domain or only some
  • The exact error message, a screenshot, and the time the error occurred
  • Your identity provider, and whether anything changed recently, such as certificate rotation, a provider upgrade, or a policy change

If Deque requests a SAML trace, most browsers offer a SAML tracer extension that can export the assertion exchange.

Support

Is this page helpful?

Help us improve this page

Still need help?