Troubleshoot SSO and SCIM errors

Error

How to fix it

Missing SSO configuration for {email} ({company_id})

Complete the SSO configuration in Klaviyo, then click Save.

SSO disabled for {email} ({company_id})

In Klaviyo, select Enable SSO under SSO Settings.

Missing SSO configuration for ({company_id})

Complete the SSO configuration in Klaviyo, then click Save.

SSO disabled for ({company_id})

In Klaviyo, select Enable SSO under SSO Settings.

Cannot provision new SSO user for {email} in account ({company_id}) (Just-in-Time provisioning not enabled)

If you want Klaviyo to create users when they first log in with SSO, select Just-in-time (JIT) provisioning under SSO Settings in Klaviyo.

IdP-Initiated SSO is disabled for {email} ({company_id})

To let users start login from your IdP, select IdP initiated log in under SSO Settings in Klaviyo.

Missing SSO configuration for ({company_id})

Complete the SSO configuration in Klaviyo, then click Save.

Name in Klaviyo is {Klaviyo name} which does not match the SCIM message of {IdP name}

For a user in multiple Klaviyo accounts, update their first and last name in your IdP to match Klaviyo. Alternatively, ask the user to update their name in Klaviyo to match your IdP. Then retry the SCIM update.

Error

How to fix it

Unsupported SAML version

Go to your IdP SSO provider and update to SAML 2.0.

Missing ID attribute on SAML Response

Make sure your IdP includes an ID attribute on the SAML Response element. This is the response’s identifier, not the IdP issuer or the user’s email address.

Missing role attribute

In your IdP, include a role attribute in the SAML assertion’s AttributeStatement. Use a role for the type of account you’re configuring. Static account and portfolio role values are listed below.

JIT provisioning cannot create an Owner or Portfolio Owner or transfer ownership. For an existing owner, the role sent by your IdP must match their current owner role.

Account user roles:

• owner
• admin
• manager
• analyst
• campaign_coordinator
• content_creator
• support
• social_media_manager

Portfolio user roles:

• portfolio_owner
• portfolio_admin
• portfolio_manager
• portfolio_analyst

SAML Response must contain 1 assertion

Configure your IdP to send exactly 1 assertion in each SAML response.

Invalid SAML Response. Not match the saml-schema-protocol-2.0.xsd

Make sure your SAML response adheres to the SAML 2.0 schema.

The Assertion must include a Conditions element

Ensure that the SAML response assertion for your IdP includes a Conditions element.

The Assertion must include an AuthnStatement element

Ensure that the SAML response assertion for your IdP includes an AuthnStatement element.

There is an EncryptedAttribute in the Response and this SP not support them

Klaviyo does not support when an attribute is encrypted. Check the settings for your IdP and make sure no attribute is encrypted.

The response has an empty Destination value

In your IdP, set the destination to the Klaviyo SSO URL shown in Klaviyo’s SSO setup. The field name varies by provider. Common names include “Reply URL,” “ACS URL,” “Assertion Consumer Service URL,” “Trusted URL,” and “Endpoint URL.”

%s is not a valid audience for this Response

Make sure that the audience Id in your IdP matches exactly with the Audience URI (Service Provider Entity ID) provided in your SSO configuration panel, including the https:// prefix.

Invalid issuer in the Assertion/Response (expected %(idpEntityId)s, got %(issuer)s)

In Klaviyo’s SSO setup, make sure IdP Issuer matches the issuer (entity ID) in your IdP’s SAML response, then click Save.

The attributes have expired, based on the SessionNotOnOrAfter of the AttributeStatement of this Response

Retry logging in. If that doesn’t work, extend the expiration window for your SAML response in your IdP, as it may be too short.

A valid SubjectConfirmation was not found on this Response

Check that the assertion contains a valid SubjectConfirmation with the bearer method and SubjectConfirmationData. Verify that its recipient matches the Klaviyo SSO URL, its validity period includes the current time, and any InResponseTo value matches the response.

The Assertion of the Response is not signed and the SP require it

In your IdP, turn on signing for SAML assertions.

Contact your IdP if you need help.

No Signature found. SAML Response rejected

Make sure your IdP signs the SAML assertion. Signing only the response does not meet Klaviyo’s assertion-signing requirement.

Signature validation failed. SAML Response rejected

In Klaviyo’s SSO setup, make sure IdP certificate matches the certificate your IdP uses to sign SAML assertions. Save any changes, then test SSO again.

SAML Response not found, Only supported HTTP_POST Binding

Check that your IdP is sending a HTTP_POST request.