SAML Error Codes

This topic documents the error codes and messages that are generated when your IdP returns an invalid SAML response during user login through SSO. The messages can be used to troubleshoot configuration issues related to federated authentication and your IdP.

The errors are displayed with each failed login attempt. They are also stored for up to 7 days in the Snowflake Information Schema and can be queried using the LOGIN_HISTORY , LOGIN_HISTORY_BY_USER table functions.

Error Code	Error Message	Explanation
390133	SAML_RESPONSE_INVALID	The SAML response was invalid for an unspecified reason, although it is most likely malformed (this is also used if there is an error on parsing).
390165	SAML_RESPONSE_INVALID_SIGNATURE	The SAML response contains an invalid Signature.
390166	SAML_RESPONSE_INVALID_DIGEST_METHOD	The SAML response contains an invalid “DigestMethod” attribute or omits it entirely.
390167	SAML_RESPONSE_INVALID_SIGNATURE_METHOD	The SAML response contains an invalid “SignatureMethod” or omits it entirely.
390168	SAML_RESPONSE_INVALID_DESTINATION	The “Destination” attribute in the SAML response does not match a valid destination URL on the account.
390169	SAML_RESPONSE_INVALID_AUDIENCE	The SAML response does not contain exactly one audience or the audience URL does not match what we expect the audience URL to be.
390170	SAML_RESPONSE_INVALID_MISSING_INRESPONSETO	The “InResponseTo” attribute in the SAML assertion is missing.
390171	SAML_RESPONSE_INVALID_RECIPIENT_MISMATCH	The “Recipient” attribute does not match a valid destination URL.
390172	SAML_RESPONSE_INVALID_NOTONORAFTER_VALIDATION	This typically indicates that the time in which the SAML assertion is valid has expired.
390173	SAML_RESPONSE_INVALID_NOTBEFORE_VALIDATION	This typically indicates that the time in which the SAML assertion is valid has not yet come.
390174	SAML_RESPONSE_INVALID_USERNAMES_MISMATCH	The login names do not match during re-authentication.
390175	SAML_RESPONSE_INVALID_SESSIONID_MISSING	During re-authentication, we were unable to find a session corresponding to the user.
390176	SAML_RESPONSE_INVALID_ACCOUNTS_MISMATCH	During re-authentication, the names of the accounts were found to not match.
390177	SAML_RESPONSE_INVALID_BAD_CERT	The x.509 certificate contained in the SAML response is either malformed or does not match the expected certificate.
390178	SAML_RESPONSE_INVALID_PROOF_KEY_MISMATCH	The proof keys do not match with respect to the authentication request ID.
390179	SAML_RESPONSE_INVALID_INTEGRATION_MISCONFIGURATION	The SAML IdP configuration is invalid.
390180	SAML_RESPONSE_INVALID_REQUEST_PAYLOAD	During authentication, using an invalid payload or using an invalid federated OAuth connection string.
390181	SAML_RESPONSE_INVALID_MISSING_SUBJECT_CONFIRMATION_BEARER	The Subject confirmation with Bearer method is missing and cannot be validated.
390182	SAML_RESPONSE_INVALID_MISSING_SUBJECT_CONFIRMATION_DATA	The Subject confirmation data is missing in the assertion.
390183	SAML_RESPONSE_INVALID_CONDITIONS	The SAML assertion is not valid for a reason that is different than the preceding conditions in this table.
390184	SAML_RESPONSE_INVALID_ISSUER	The SAML Response contained an issuer/entityID value different from the one configured in the SAML IDP Configuration.