SSO Troubleshooting

Common errors and what they mean

Start here. If your symptom is listed, you may be able to resolve it without capturing a trace.

What you see	Likely cause	Fix
Microsoft error `AADSTS20012` (“WS-Federation message … invalid”)	The Login/Logout URL is pointing at your WS-Federation endpoint (`.../wsfed`) instead of SAML 2.0 (`.../saml2`).	We correct the endpoint on our side. If you reported the URLs, resend the `.../saml2` endpoint.
Microsoft authenticates, but ScopeStack shows “Could not sign you in”	Certificate or signature mismatch — often a fingerprint/thumbprint configured with the wrong hash algorithm.	We reconfigure using your full signing certificate and no fingerprint. Resend the certificate as plain text if needed.
Login loops back to the ScopeStack sign-in page	The user isn’t enabled for SSO yet, or the `NameID` in the response doesn’t match the user’s ScopeStack email.	Confirm the user is assigned in your identity provider and that `NameID` is the user’s email.
SSO works for most users, but one person is prompted for a password (and can still sign in with one)	That specific user isn’t assigned/enabled for the ScopeStack app in your identity provider, or their `NameID`/UPN no longer matches their ScopeStack email.	Confirm that user is assigned in your identity provider and that their `NameID` matches their ScopeStack email. When it’s isolated to one user while others sign in fine, the fix is in your identity provider, not ScopeStack.
Signed in, but your name or email is wrong or missing	Your identity provider isn’t sending the expected attributes.	Map `NameID` to email and include the `email` and `name` attributes (see Required Attributes below).

If your issue isn’t listed, capture a SAML trace and send it to Support using the steps below.

A desktop browser:

Chrome (recommended)
Firefox (alternative)
Edge (alternative)

A SAML tracing extension:

- SAML-tracer for Firefox
  - **SAML Chrome Panel for Chrome
    **
  - SAML oAuth Tracer for Edge

Steps to Capture a SAML Trace

1. Launch the Tracing Tool

Open SAML-tracer from your browser’s toolbar.
It opens in a new window and starts recording requests automatically.

In a new tab, go to 👉 https://app.scopestack.io
Enter your work email address.
The app will detect your domain and redirect you to your Azure login page.
Continue the login flow until the error occurs or you’re redirected unexpectedly.

⚠️ Important: Keep the SAML-tracer window open while you complete the login attempt.

3. Review the SAML Traffic

In the SAML-tracer window:

Look for HTTP POST requests with URLs that include /saml or /acs.
Click one of these entries.
In the right-hand pane, look under the SAML tab.

You’ll see:

A SAML Request going to Azure from ScopeStack
A SAML Response coming back from Azure to ScopeStack

✅ You should see your email under NameID and attributes like email, name, etc.
🚫 If the response is missing key fields or shows an error, that could be the source of the issue.

💾 Export the Trace

After you’ve captured the full flow:

Firefox:

Click the 💾 Save icon in SAML-tracer to export a .har file

Chrome:

Right-click in the SAML Chrome Panel > Save as HAR with content

📬 Send to Support

Please email the exported file to: support@scopestack.io
Include:

Your email address
Time of your login attempt
A short description of what you saw (error message, unexpected loop, etc.)

Subject Line:
SSO Login Issue – SAML Trace Attached

Required Azure Attributes

ScopeStack expects these in your SAML Response:

NameID = your email address
Attributes:
- email
- name
- firstName (optional)
- lastName (optional)

Need help interpreting the trace or checking your configuration? Contact support@scopestack.io.