Release Incident Playbook

SSO login broken: symptoms, cause, and the test that catches it

Single sign-on fails after an identity provider, certificate or callback URL change.

SSO login broken is documented by 5 accepted public reports from 5 organisations, 5 of them published in the last 5 years.

  • Likelihood: medium (5 public reports in 5 years)
  • Impact: medium (5 of 5 reports: availability)

5 public reports · verified 2026-10-21

Symptoms

User-visible

  • SAML SSO login fails with a redirect error after the sign-in starts.[3]
  • Some users see an "invalid signature" error when signing in with SSO.[4]
  • Only customers with certain identity provider configurations are blocked, while other login methods keep working.[5][2]
  • Customers whose identity provider certificate fails a new expiration date check cannot log into the console.[1]

Monitoring-visible

  • Scattered SSO login complaints first look like isolated cases and are escalated only once their volume grows.[4]
  • Customer reports are the first signal, with one incident logged about three days after the change.[3][1]
  • User reports of SAML SSO errors start the same morning as the authentication change; other login methods were not affected.[2]

Root causes

  1. stage: code The SSO init request moved the customer id from a GET to a POST parameter and switched to a new host, so the callback redirect_uri no longer matched the registered value.[3]
  2. stage: code A change to the SAML request that sent a new service provider certificate made some identity provider configurations reject the request.[5]
  3. stage: code New code that validated the expiration date of certificates sent by customer identity providers rejected some of those certificates and blocked the login.[1]
  4. stage: release-process Pre-release testing passed against the company's own identity provider and one new test setup, neither of which matched the affected customer configurations.[3]

Public examples

  1. [1]KnowBe4, 2024-11-27. An update added validation of the expiration date of SAML SSO certificates sent by customers' identity providers, and some certificates failed it, so those users could not log into the KSAT console for about 34 minutes. primary KSAT - Login Issues
  2. [2]Smartsheet, 2024-05-16. An authentication change caused errors for users of specific SAML SSO configurations until it was reverted about two and a half hours after the first reports. primary Investigating Partial Outage for Logging into Smartsheet using SSO/SAML
  3. [3]Phrase, 2024-02-06. A change to the SAML SSO init process moved a customer parameter from GET to POST and switched the host, so the callback redirect_uri no longer matched and customers could not log in via Strings SAML for about three days. primary Unable to log in via Strings SSO login (redirect issue)
  4. [4]Mural, 2023-07-18. A change to the SAML SSO login flow released to production caused some users to receive an invalid signature error when signing in with SSO until the change was rolled back the next day. primary Invalid signature error when signing in with SSO
  5. [5]Keeper Security, 2022-08-09. A change to the SAML request made to send a new SSO certificate caused some identity provider configurations to reject the request, blocking SSO login for some customers until the change was reverted. primary SSO Login Issue

Test classes that catch it

Test classStageLimitationBasis
End-to-end testspre-deployAn end-to-end SSO test passes against the one or two identity provider setups it is wired to, while the reported failures hit only specific customer configurations, certificates or redirect hosts.by design analysis
Synthetic monitoringpost-deployA synthetic SSO login catches the break only for the identity provider configuration its script signs in with, so a fault limited to one certificate type or one SAML setup goes unseen.by design analysis

Risk

  • Likelihood: medium (5 public reports in 5 years)
  • Impact: medium (5 of 5 reports: availability)
Counts behind the grades
Accepted public reports5
Published in the last 5 years5
Impact stated: availability5

How the grades are computed

Pre-release checklist

  • PR-01
  • PR-02
  • PR-03
  • PR-04
  • PR-05

First 30 minutes

  • FM-01
  • FM-02
  • FM-03
  • FM-04
  • FM-05
  • FM-06
  • FM-07

Download the checklist

What catches this: catalogue entries

Listed because their own documentation or site names end-to-end tests, synthetic monitoring on the verification date. Alphabetical. Not a recommendation.

Tools whose documentation names these test classes

Providers whose site names these test classes

Only on this page

In report [3], SSO login broken took 4,285 minutes to detect, about three days between the SAML init change and the incident being logged. Detection came only after several customer reports were escalated.

In that report the change moved a customer parameter from GET to POST and moved the init host, and both broke the redirect_uri match [3]. The change had passed testing against the company's own identity provider and a new test setup, so only customer tenants exercised the broken redirect.

Questions

What causes SSO login broken?

All 5 primary reports name a code change in the SAML login flow. The reported changes include a redirect_uri mismatch [3], a new service provider certificate in the SAML request [5] and a new certificate expiration check [1].

What are the symptoms of SSO login broken?

Users with specific identity provider configurations see redirect or invalid signature errors and cannot log in, while other login methods work. In 4 of the 5 reports, detection came from customer or user reports.

Why did tests not catch SSO login broken?

One report states that testing passed against the company's own identity provider and a new test setup [3]. The failures hit only specific customer configurations that those tests did not cover.

Which test class catches SSO login broken, and what does it miss?

End-to-end tests and synthetic monitoring are listed by design, with no cited basis. Both miss failures limited to identity provider configurations their scripts do not sign in with.

How long did it take to detect SSO login broken in the public reports?

One report measures 4,285 minutes, about three days, from the change to the logged incident [3]. Another report treated early complaints as isolated and activated a taskforce the next morning [4].

Should a team roll back or fix forward when SSO login broken happens?

Four of the 5 reports restored login by reverting or rolling back the change, and one fixed forward the same morning [3]. Checklist item FM-03 reverts the SSO change once failures cluster on it.

Release Incident Playbook (2026). SSO login broken: symptoms, cause, and the test that catches it, content version 1.0.0. https://releasefailures.com/incidents/sso-login-broken/. Accessed 2026-10-21.