Troubleshooting Single Sign On

Home > Integration > Essential Integrations > Single Sign On with SAML 2.0 > Trouble Shooting Single Sign On

Introduction Hornbill's Single Sign On implementation is designed to present you with helpful error messages in situations where something may not be quite right. This page outlines the common scenarios and what to do to overcome them. If the SSO is enabled and not working correctly, this will manifest itself as one or more users being able to login. If it becomes necessary to disable a single sign on profile, it is possible to do this using the Hornbill "admin" account. It is possible to bypass the Single Sign on Profile using this URL: https://admin.hornbill.com/<instance_id>/?ESPBasic=true which allows you to login using the "admin" account and take the necessary action to correct the configuration or disable the single sign on Profile. The <instance_id> needs to be replaced with the ID of your instance. The user will have the option to log into Hornbill using the Hornbill user ID and password thus bypassing the SSO profile.

Related Articles Single Sign On with SAML 2.0 Single Sign on Profiles

Common Issues

I can no longer access Hornbill

A common symptom of the error message below is the expiry or renewal of an ADFS Server signing certificate. By default, the ADFS AutoCertificateRollover property is set to true so the certificates could change without any direct action.

This can be rectified by supplying the new certificate key for the Hornbill SSO Profile. Please contact the security or administration team within your company to request for a refreshed ADFS Server certificate key.

In the example below, clicking on + icon under Certificates section allows you to supply a new ADFS signing certificate. This can be achieved through the Admin Tool:

• Admin Tool > System > Security > SSO Profile (e.g. https://admin.hornbill.com/instance-name/security/profiles/)

As a general principle, we advise that the team responsible for security or administration within your company can schedule a task to update the Hornbill SSO profile with the new certificates, prior to the expiry of them.

Please refer to "Related Articles" in this page for information relating to Hornbill SSO Profiles.