Troubleshooting Error Codes for Single Sign-On (SSO)

E-UM-1000

This error occurs when an Inactive user attempts to access the OneTrust application via SSO.

Only Active users can access the OneTrust application via SSO.

• If the Inactive user should have access to the OneTrust application, Site Admins can activate the user through User Management > Users in Global Settings. In the Status field on the Users screen, select Inactive, locate the Inactive user, and activate as necessary.

E-UM-1002

This error occurs when the mapping of the role for that organization is either missing or incorrect.

If Just-In-Time Provisioning (JIT) is disabled, you must pass valid Role values from your Identity Provider (IdP) to the OneTrust application.

• Ensure that the Role attribute key value on the Attribute Mappings tab of the Single Sign-On screen is an identical match in both your IdP and the OneTrust application.

• Ensure that the roles configured within your IdP are correctly mapped to the roles within the OneTrust application on the Assignments tab of the Single Sign-On screen.

E-UM-1009

This error occurs when the domain is in Pending or Failed status.

The domain must be in either Verified or Accepted status.

• You can verify domain ownership on the Domains tab of the Single Sign-On screen.

• For accounts with a custom subdomain or fully qualified domain name (FQDN), domains added on the Domains tab will be automatically placed in Accepted status.

E-UM-1010

This error occurs when the user is not present in the OneTrust application and Just-In-Time (JIT) Provisioning is disabled.

The user must exist in the OneTrust application in order to log in. One of the following methods can be used to resolve this error:

• Manually add the user to the OneTrust application using the Users screen; or

• Turn on the Enable Just-In-Time Provisioning setting on the Attribute Mappings tab of the Single Sign-On screen.

E-UM-1013

This error occurs when attribute keys for basic attributes (First Name, Last Name, Email) are either missing or incorrect.

You must pass valid First Name, Last Name, and Email attribute values from your Identity Provider (IdP) to the OneTrust application.

• Ensure that the First Name, Last Name, and Email attribute key values on the Attribute Mappings tab of the Single Sign-On screen are an identical match between both your IdP and the OneTrust application.

E-UM-1014

This error occurs when the IdP entity ID passed in the assertion is not configured on the Service Provider side.

The IdP's entity ID configured within the OneTrust application must match the issuer value sent in the SAML assertion.

• On the Single Sign-On screen in the OneTrust application, update the IdP's entity ID value within the Name field in the Identity Provider Configuration section to match the issuer value sent in the SAML assertion.

E-UM-1016

This error occurs when an email address change request is initiated but has not been verified.

The user must either cancel or verify the email address change request.

• When a change is made to a user's email address and the Require Users to Confirm Email Address Change setting is enabled in Global Settings, an email message will be sent to the new email address with a link to confirm the change.

• Until the new email address is verified by the user, their email address will remain unchanged and the error will persist.

E-UM-9001

This error occurs when the message sent from the IdP is not a Response object type.

The message submitted to the Assertion Consumer Service (ACS) URL should be an AuthNResponse.

• Please check your IdP and pass the proper response type.

E-UM-9002

This error occurs when the response has an invalid status code.

The status code passed in the SAML assertion must be valid. The accepted status code is urn:oasis:names:tc:SAML:2.0:status:Success. Please check your IdP to determine why user authentication failed.

• Verify that the user has permissions to access the OneTrust application in your IdP.

• Ensure that the user's supplied credentials are accurate for successful authentication.

E-UM-9003

This error occurs when the signature used for signing the assertion is invalid or not trusted.

The authentication certificate issued by your IdP to sign the assertion must be current and valid.

• Download the current authentication certificate from your IdP.

• Ensure that this certificate is used in the Upload Certificate section of the Single Sign-On screen in the OneTrust application.

E-UM-9004

This error occurs when the response issue time is either too old or has a date in the future.

The assertion validity period should not extend more than 5 minutes after generation.

• Verify that the date and time settings for both the user's device and the IdP are correctly synced.

E-UM-9006

This error occurs when the InResponseTo field of the response does not correspond to the sent message.

The InResponseTo attribute value must match what is sent by OneTrust.

• For Service Provider-initiated flows, ensure the IdP is not configured to remove or modify the InResponseTo attribute.

• For IdP-initiated flows, ensure the IdP does not send any values for the InResponseTo attribute.

E-UM-9007

This error occurs when the sent request is a different type than the expected AuthNRequest.

OneTrust supports the SAML 2.0 protocol for the AuthNRequest. Therefore the response must contain a supported Authentication Content Class.

• Ensure the IdP is configured to require a supported SAML 2.0 authentication context class.

E-UM-9008

This error occurs when the ACS URL configured in the IdP doesn't match the ACS URL for the OneTrust application.

The ACS URL provided in OneTrust's environment metadata must match what is entered in the SAML Configuration within your IdP.

• Download the metadata file for your application environment from the Single Sign-On screen and locate the URL corresponding to the AssertionConsumerService attribute. This ACS URL should be added in a corresponding field within your IdP. The name of this field may vary depending on your IdP (e.g. Single Sign On URL, Reply URL, ACS URL etc.).

E-UM-9009

This error occurs when the Issuer value does not match the entity ID.

The IdP's entity ID configured within the OneTrust application must match the issuer value sent in the SAML assertion. One of the following methods can be used to resolve this error:

• On the Single Sign-On screen in the OneTrust application, update the IdP's entity ID value within the Name field in the Identity Provider Configuration section to match the issuer value sent in the SAML assertion; or

• In your IdP, update your SAML Configuration to send the entity ID value that matches the Identity Provider Configuration > Name field value within the Single Sign-On screen in the OneTrust application.

E-UM-9010

This error occurs when the NameID element is not present as part of the subject in the response message.

The NameID element (i.e. email address) must be present in the SAML assertion.

• Ensure that the NameID element is added to the SAML assertion in your IdP and verify that the correct attribute mapping is configured between your IdP and the OneTrust application.

E-UM-9011

This error occurs when the response does not have any valid assertion which would pass subject validation.

A valid SAML assertion that includes Issuer, Subject, Conditions, and AudienceRestriction values must be passed in the response.

• Verify that the assertion is there and has valid values passed.

  
  
  

ERROR-001

This error occurs when the entered domain is not valid.

The email address entered when accessing the Lockout URL must be valid.

• Ensure that a valid email address is entered in the Email Validation Form upon accessing the Lockout URL.

ERROR-002

This error occurs when the entered domain is not present.

The email address entered when accessing the Lockout URL must exist within a OneTrust account associated with the Lockout URL.

• Ensure that the email address entered in the Email Validation Form upon accessing the Lockout URL exists within the OneTrust account associated with the Lockout URL.

ERROR-003

This error occurs when the user is external, expired, or disabled.

Only Internal, Active Site Admins in the root organization can use the Lockout URL self-service flow to disable SSO and resolve SSO lockout.

• Ensure that the email address entered in the Email Validation Form upon accessing the Lockout URL is associated with an Internal, Active Site Admin user in the root organization.

ERROR-004

This error occurs when the user is not a Site Admin in the root organization.

Only Internal, Active Site Admins in the root organization can use the Lockout URL self-service flow to disable SSO and resolve SSO lockout.

• Ensure that the email address entered in the Email Validation Form upon accessing the Lockout URL is associated with an Internal, Active Site Admin user in the root organization.

ERROR-005

This error occurs when SSO has already been disabled for the account.

If SSO is disabled, you can access the OneTrust application using your email address and password.