Here’s a practical troubleshooting checklist for On-Premise customers when SSO is not working, focused on Qmarkets SAML SSO and the infrastructure components that can affect authentication.


Recommended first checks: 

If SSO was working previously and suddenly stopped, start with the certificates (SP & IdP) expiration checks (step 2).


1. Identify the scope of the issue

  • Is the issue affecting all users or only specific users?

  • Is SSO failing for the first time, or was it previously working?

  • Did the issue start after a certificate renewal, server upgrade, URL change, or IdP configuration change?

  • Can users log in using an alternative authentication method, if enabled?

This helps determine whether the issue is related to the SAML configuration, a specific user, or the on-premise infrastructure.


2. Check SP and IdP certificates

  • Qmarkets SP certificate: Is it expired? Does the certificate configured in the Qmarkets SAML endpoint match the certificate configured in the customer's IdP application?

  • IdP signing certificate: Is it valid and does its public certificate match the one Qmarkets uses to validate SAML responses?

  • Metadata: Does the current IdP metadata contain the correct signing certificate and endpoints?

                

                Expired or mismatched certificates are a common cause of SSO failures. 


3. Verify the SAML configuration

  • Confirm the Qmarkets SAML endpoint metadata URL/file is applied to the IdP SAML application.

  • Confirm that the Assertion Consumer Service (ACS) URL is correct in the IdP SAML application.

  • Verify the NameID format and value (e.g., username or email) and ensure the corresponding user exists in Qmarkets.

  • Ensure the IdP application is enabled and assigned to the relevant users.


                For ADFS, also check the relying party trust, claim issuance rules, and current token-signing certificate.


4. Check the on-premise infrastructure

  • System time: Are the application server and IdP clocks synchronized? Significant time differences can cause SAML assertion validation failures.

  • Check the logs: Are the relevant web server, application, and IdP services running without errors?

 

5. Use the error message to narrow down the cause


Error / symptom

What to check first

An invalid SAML response was given

Signing certificate, response signature, audience, recipient, and assertion conditions

Signature validation failed

IdP signing certificate and certificate rollover

NameID missing

IdP claim rules and NameID mapping

Authentication attempt failed

Qmarkets authentication logs and the underlying SAML validation error

403 Forbidden

WAF/firewall logs, IP restrictions, permissions, and blocked requests

Redirect loop or repeated login

Cookies/session, ACS URL, Entity ID, and IdP/SP configuration

SSO stopped working suddenly

Certificate expiration, metadata changes, URL changes, or recent infrastructure updates


6. What to send Qmarkets' support:

If the issue remains unresolved, collect the following:

  • Exact error message and screenshot.

  • Affected username and approximate time of the failed attempt.

  • Whether all users are affected or only specific users.

  • Qmarkets application logs for the failed attempt.

  • IdP/ADFS event logs.

  • Any recent changes to certificates, metadata, DNS, firewall rules, or system configuration.


7. Prevent future incidents

  • Configure advance expiration alerts for both SP and IdP certificates.

  • Document certificate renewal and rollover procedures.

  • Keep a record of the active certificate thumbprints and expiration dates.

  • Validate SSO after certificate updates and infrastructure changes.

  • Keep separate, verified SAML configurations for Production and Staging.

  • Ensure relevant logs and monitoring alerts are available to the support team.