'InResponseTo: Invalid' SAML assertions fail

Service provider initiated flow

In a SAML Service Provider (SP) initiated login flow, when an unauthenticated user tries to open a Salesforce URL, a SAML request is generated by Salesforce and sent to the configured Identity Provider (IdP), who must then authenticate the user and send back a SAML response.

In this case, a SAML SSO login flow may fail with 'InResponseTo: Invalid' in the following scenarios.

1. The SAML response contains an InResponseTo value that does not match that of the SAML request.
2. The InResponseTo value is generated as soon as the My Domain page loads, and expires after 8 minutes. As a result, this error is returned if the SAML response is sent to Salesforce more than 8 minutes after loading the My Domain page.

Identity provider initiated flow

On another hand, in the IdP initiated flow, the same error message may be returned if the SAML response contains an InResponseTo value, which is unexpected in this scenario.

For more information on SAML Request and Response, please see the Salesforce Help on SAML SSO Flows or watch the Support YouTube video on how to Capture SAML Request and Response Using the SAML Tracer Extension .

Visit the Salesforce Developer Community to start a discussion or review past discussions on SSO Login errors.