Advanced Troubleshooting for SAML/OIDC Integration in Schedly |

Overview

SAML (Security Assertion Markup Language) and OIDC (OpenID Connect) are authentication protocols that allow secure single sign-on (SSO) to services like Schedly. These protocols streamline user access and enhance security by using a single set of credentials across multiple applications. This article will help you troubleshoot common SSO integration issues, ensuring your Schedly experience remains smooth and secure.

Prerequisites

Ensure you have administrative access to Schedly and your identity provider's control panel for SAML/OIDC configurations.
Verify that your organization's SAML/OIDC protocols are set up to communicate with Schedly for single sign-on.

Step-by-Step Instructions

Identify Common SSO Configuration Issues

Confirm Domain Verification: Ensure that your organization's domain is correctly verified within Schedly settings, as any discrepancy can cause authentication failures.
Check SAML Assertions and OIDC Claims: Verify that the SAML assertions or OIDC claims being sent from your identity provider are correct and map accurately to Schedly's expectations.
- Ensure the 'NameID' and 'Subject' claims are set correctly to match the email addresses used in Schedly.

Check Integration Settings for Errors

Navigate to Schedly Developer Tools: Access the API & Developer Tools section by clicking on Schedly Services from the main navigation.
Review Configuration Details: In the SSO settings, examine the integration details to ensure all fields such as Metadata URLs, Entity ID, and ACS (Assertion Consumer Service) URL are correctly entered.
Verify Certificate Details: Check that any X.509 certificates uploaded to Schedly match those provided by your identity provider.

Steps to Reconnect Your SAML/OIDC Service

Remove Current Integration: If the setup is incorrect, navigate to your SAML/OIDC settings in Schedly and remove the existing configuration by clicking the corresponding Remove Integration button.
Reconfigure SSO Settings: Re-enter all required information, ensuring correct URLs and fields are used, and deploy any necessary certificates.
Perform a Test Sign-In: Once reconfigured, attempt to log in using the Sign in with SAML/OIDC option on the Schedly login page to confirm the setup is successful.

Key Details & Limits

Supported Protocols: Only SAML and OIDC are supported for SSO integrations.
Certificate Requirements: X.509 certificates must be correctly uploaded and valid for encryption purposes.
Error Logs: Access error logs from the Developer Tools section in Schedly for detailed debugging information.

Frequently Asked Questions

What causes SSO login failures in Schedly?
- Common causes include incorrect domain verification, misconfigured identity provider settings, and invalid certificates.
How can I verify my domain in Schedly?
- Navigate to domain settings within Schedly, and follow the instructions for domain verification using DNS records.
Why do I get certificate errors?
- Ensure that the uploaded X.509 certificates match those issued by your identity provider and are not expired.
Can I use SAML and OIDC simultaneously?
- While both can be set up, only one protocol should be active per organization to avoid conflicts.
What should I do if I can’t log in after SSO setup?
- Recheck all integration details, confirm with your identity provider that the SAML assertions/claims are correct, and perform a reconnect as needed.

Troubleshooting

SSO Login Redirects to Error Page:
- Verify that the ACS URL configured in Schedly matches the identity provider's settings exactly.
Invalid Credentials Error:
- Ensure that the credentials (e.g., 'NameID') provided by your identity provider are correctly mapping to Schedly user accounts.
Token Expiration Errors:
- Check token lifetime settings in your identity provider and adjust as needed to prevent token timeouts.

Appearance

Advanced Troubleshooting for SAML/OIDC Integration in Schedly