# Troubleshooting SAML authorization errors

Last updated 10 days ago

### Who can use this feature

- Supported on **Team** and **Enterprise** plans
- Note: **Team** plans are limited to Okta and Google SAML only
- Org admins and IT admins can edit SSO settings

[SAML-based single sign-on](https://support.writer.com/article/43-setting-up-saml-sso) (SSO) gives members access to WRITER through an identity provider (IDP) of your choice. If you’re having trouble setting this up, find your error message in the table below to learn how to fix it.

## What causes SAML errors?

SAML errors usually occur when there’s missing or incorrect information entered during your SAML setup. You can resolve most of these issues from your IDP settings, but for some, you’ll need to update your SSO settings in WRITER as well.

## SAML error messages

|     |     |
| --- | --- |
| **Error message** | **How to fix it** |
| SAML request creation error: No idp entityId found | The IdP metadata is invalid, possibly expired.<br>Go to the WRITER SAML settings page. Upload the metadata from the IdP as described [here](https://support.writer.com/article/43-setting-up-saml-sso#Section-B-From-your-IdP-into-Writer--KZpf9). |
| SAML response parsing error: Subject confirmation validation failed | The SAML request `SubjectConfirmationData`  is invalid. Usually the `Recipient`  attribute is absent or incorrect.<br>Copy the `SP ENTITY I`  field value from the WRITER SAML settings page to the `Recipient/Audience/Entity ID`  field on the IdP settings page as described [here](https://support.writer.com/article/43-setting-up-saml-sso?preview=61f580ac8200bc052eb83d28#Share-information-from-Writer-with-your-identity-provider-IdP-ZECRu). |
| Request contain invalid SP Entity ID | The SAML IdP settings are incorrect because the `SP EntityID`  is wrong.<br>Copy the `SP ENTITY I`  field value from the WRITER SAML settings page to the `Recipient/Audience/Entity ID`  field on the IdP settings page as described [here](https://support.writer.com/article/43-setting-up-saml-sso?preview=61f580ac8200bc052eb83d28#Share-information-from-Writer-with-your-identity-provider-IdP-ZECRu). |
| Given email domain is not bound to your organization | The SAML IdP returns an email with a different domain than the one configured during setup.<br>Add the given email domain to the _SAML domain management_ section of the WRITER single sign-on settings page [here](http://app.writer.com/admin/sso). |