A failed SAML sign-in now says what went wrong
When a SAML sign-in fails, the message names the cause, such as a signing certificate that no longer matches, and who can fix it.
When a SAML sign-in failed, almost every cause showed the same message: something was probably misconfigured, either at the identity provider or in Screenly. It never told you which one to fix.
The message now names the cause and who can fix it. The most common one is an identity provider that has rotated its signing certificate. The message says the certificate saved in Screenly no longer matches and asks a workspace owner to update it in Screenly's SAML settings, which are under Settings > Security > "SAML single sign-on". The other causes Screenly now recognizes:
- The identity provider didn't sign the sign-in.
- The sign-in expired before it reached Screenly, which usually means the identity provider's clock is out of step.
- The identifier set in the identity provider doesn't match the Entity ID in Screenly.
- The identity provider sent the sign-in to a different reply URL than Screenly expects.
- The sign-in link points to a SAML configuration that no longer exists.
Anything else still shows the general message.