01
SAML 2.0Enterprise federation
Assertions, metadata, certificates, ACS URLs and NameID mapping.
Open field guide → Authentication troubleshooting, without the guesswork
When sign-in
breaks, start here.
Practical diagnostics for SAML, OAuth 2.0 and OpenID Connect. Find the failure, understand the cause and get your users back in.
✓ No account required✓ Privacy-first guidance✓ Built for developers & IT teams
auth-diagnostic.logLIVE
23:41:06 SSO request received
23:41:06 Protocol OpenID Connect
23:41:07 Authorization code ✓ valid
23:41:07 Token signature ✓ verified
23:41:07 Audience claim ✕ mismatch
!
LIKELY CAUSE
Token audience does not match this client ID.
01
CHECK NEXT
Compare the aud claim with your configured client identifier.
01 — Quick diagnosis
What are you seeing?
Choose the symptom closest to your issue. We’ll point you toward the most likely checks—without asking for secrets.
Recommended first check
⌾
Keep credentials out of diagnostics.
Never paste passwords, active access tokens, refresh tokens, session cookies or private signing keys. Redact personal data before sharing logs.
02 — Protocol field guides
Know where to look.
Each protocol fails differently. Start with the moving parts that matter.
02
OAuth 2.0Delegated access
Authorization codes, PKCE, scopes, redirect URIs and consent.
Open field guide →03
OpenID ConnectModern identity
ID tokens, discovery, nonce, claims, JWKS and userinfo.
Open field guide →03 — The five-minute check
Before you change anything.
Most authentication incidents can be narrowed down with five calm, repeatable checks.
- 01Confirm the blast radius
One user, one tenant, one application—or everyone?
- 02Check time and recent changes
Look for clock drift, certificate rotation and deployments.
- 03Compare exact identifiers
Issuer, audience, entity ID, client ID and redirect URI.
- 04Inspect sanitized evidence
Error codes, request IDs and timestamps—not secrets.
- 05Test the smallest safe change
Change one variable, record it, verify and roll back if needed.
● READY WHEN SSO ISN’TFind the fault.
Find the fault.
Restore access.
Start with the symptom and work toward evidence—one safe check at a time.
Start diagnosis →