# SSO Troubleshooting

<table data-header-hidden><thead><tr><th width="221"></th><th></th></tr></thead><tbody><tr><td>Issue:</td><td>Page cannot be displayed on Sso.aspx</td></tr><tr><td>Resolution</td><td><p>Make sure there is an SSL binding for the website. SSL is required.</p><p>Check that there is an spid in the query string</p><p>404 indicates non spid or an invalid spid. This must be the Service Provider Identifier and can be Url encoded.</p></td></tr></tbody></table>

<table data-header-hidden><thead><tr><th width="224"></th><th></th></tr></thead><tbody><tr><td>Issue:</td><td>Error processing login request. Invalid Login ID or Password Please Verify and re-enter your login information</td></tr><tr><td>Resolution</td><td>Using the recommended configuration, where SAML Name ID is mapped to User Principal Name by the IdP, the user name will be compared to User Qualified Name (USER_QUALIFIED) and NT Account Name (USER_SAM). Both must equal the User Principal Name, which should be in the form name@domain</td></tr></tbody></table>

<table data-header-hidden><thead><tr><th width="224"></th><th></th></tr></thead><tbody><tr><td>Issue:</td><td>User Import doesn’t seem to work</td></tr><tr><td>Resolution</td><td>User import may fail if the update would result in a duplicate Login ID (USER_ID), User Qualified Name or NT Account Name/Domain</td></tr></tbody></table>

<table data-header-hidden><thead><tr><th width="224"></th><th></th></tr></thead><tbody><tr><td>Issue:</td><td>Could not load file or assembly 'Newtonsoft.Json, Version=4.5.0.0, Culture=neutral, PublicKeyToken=30ad4fe6b2a6aeed' or one of its dependencies</td></tr><tr><td>Resolution</td><td><p>Add the following to the configuration section of the web.config</p><p>  &#x3C;runtime></p><p>    &#x3C;assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1"></p><p>      &#x3C;dependentAssembly></p><p>        &#x3C;assemblyIdentity name="Newtonsoft.Json"</p><p>            publicKeyToken="30ad4fe6b2a6aeed" culture="neutral"/></p><p>        &#x3C;bindingRedirect oldVersion="0.0.0.0-8.0.0.0" newVersion="8.0.0.0"/></p><p>      &#x3C;/dependentAssembly></p><p>    &#x3C;/assemblyBinding></p><p>  &#x3C;/runtime></p></td></tr></tbody></table>

<table data-header-hidden><thead><tr><th width="219"></th><th></th></tr></thead><tbody><tr><td>Issue:</td><td>SignatureDescription could not be created for the signature algorithm supplied.</td></tr><tr><td>Resolution</td><td><p>The secure hash algorithm used for the Relying Party trust is not set to SHA1. ADFS defaults to SHA256, but this is not supported.</p><p>Change the hash algorithm to SHA1 on the advanced tab of the Relying Party Trust</p></td></tr></tbody></table>

<table data-header-hidden><thead><tr><th width="218"></th><th></th></tr></thead><tbody><tr><td>Issue:</td><td>Assertion Subject does not define a NameID</td></tr><tr><td>Resolution</td><td>User Principal Name should be mapped to Name ID in the IdP claims configuration</td></tr></tbody></table>

<table data-header-hidden><thead><tr><th width="218"></th><th></th></tr></thead><tbody><tr><td>Issue:</td><td>I can’t see my signing certificate</td></tr><tr><td>Resolution</td><td><p>Digital certificates must</p><ul><li>have a private key</li><li>must be installed in the local machine certificate store</li><li>be accessible to the account running the app pool</li></ul><p>Core runs under Network Service by default</p><p>The app pool must have full control of the certificate</p><p>The friendly name of the certificate should be set to make management easier.</p><p>SAML connector should now appear in the list of integration connectors:</p></td></tr></tbody></table>

<table data-header-hidden><thead><tr><th width="210"></th><th></th></tr></thead><tbody><tr><td>Issue:</td><td>Page Cannot Be Displayed Error after logging into authentication server:</td></tr><tr><td>Resolution</td><td><p><strong>Solution 1:</strong></p><p>Check that service provider ID in Core matches the SPID in the endpoint url configured in the relying party on the ADFS server</p><p>This:</p><p>Should match this:</p><p><strong>Solution 2:</strong></p><p>If you have created a new self-signed certificate, make sure that the Relying Party properties have been updated by importing the new certificate (and removing the old one).</p><p>Export the current certificate:</p><p>Import new certificate to the relying party and remove the old one:</p></td></tr></tbody></table>


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.alemba.com/asm/asm-hermes/integrate/managing-integration/single-sign-on-using-saml/sso-troubleshooting.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.