A launchpad integrated with a SaaS provider uses SSO. Users are redirected to the SaaS provider but are asked to log in. What is the most likely cause?

A launchpad integrated with a SaaS provider uses SSO. Users are redirected to the SaaS provider but are asked to log in. What is the most likely cause?

• A. Users do not exist within the SaaS provider.
• B. Group permissions are incorrect.
• C. Users do not exist in directory services.
• D. The federation is failing.

Answer: (D)

SSO relies on a trusted federation between the identity provider and the service provider. When users are redirected to the SaaS provider but are still asked to log in, it indicates the IdP’s authentication assertion isn’t being accepted by the SP, so the trust link isn’t functioning as it should. The most likely cause is a federation failure, meaning the relationship or the configuration between the IdP and the SaaS provider is broken (for example, mismatched metadata, certificate issues, or incorrect endpoints). In practice, fixing this involves verifying the federation setup—correct metadata exchange, valid certificates, proper clock synchronization, and the right assertion consumer service URL and audience restrictions. Other options would typically show up as errors after authentication or as provisioning/authorization problems, not as an immediate SP login prompt when SSO is expected.

SSO relies on a trusted federation between the identity provider and the service provider. When users are redirected to the SaaS provider but are still asked to log in, it indicates the IdP’s authentication assertion isn’t being accepted by the SP, so the trust link isn’t functioning as it should. The most likely cause is a federation failure, meaning the relationship or the configuration between the IdP and the SaaS provider is broken (for example, mismatched metadata, certificate issues, or incorrect endpoints). In practice, fixing this involves verifying the federation setup—correct metadata exchange, valid certificates, proper clock synchronization, and the right assertion consumer service URL and audience restrictions. Other options would typically show up as errors after authentication or as provisioning/authorization problems, not as an immediate SP login prompt when SSO is expected.