> For the complete documentation index, see [llms.txt](https://docs.infotopics.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.infotopics.com/writebackextreme/features/management-console/setup-security/sso-setup/troubleshooting-sso.md).
# Troubleshooting SSO
## Common error messages
A valid SubjectConfirmation was not found on this Response
This could indicate there is a mismatch between the Recipient and Destination URLs. Check in the SAML response XML if Recipient and Destination URL's match. When it does not match it should be configured in your SAML provider.
Unknown AssertionConsumerServiceURL
The URL in the configuration file is probaby incorrect. Check your wbe.config.yml file and look at the app.url variable. That should match the domain that is used to access WriteBackExtreme
SSO Login in management console works but not in extension
The return url that ends with auth/saml/login-return is probably not added to the Assertion Consumer Service URLs in your SSO provider
Cannot login in management console with SSO
* Check if the user that is trying to login has permissions to view the management console. He should be either admin or have at least one role attached. And he should not be blocked
* Check the logs in the management console. (Info & License->System Logs, click the log of that specific day) Maybe there is a clue stored in there.
* Check the attributes in your IDP provider. The username should match the username that you have in the management console.
Authentication method by which the user authenticated with the service doesn't match requested authentication method
This problem occures/happends, because of the way how the session authentication method (SAML AuthnRequest) is configured on the other SSO app. WritebackExtreme by defaults use “Password, ProtectedTransport” as request authentication method.
**Solution**
We have added a configuration variable to allow all options, but allow any cross request authentication method. Within the wbe.config.yaml file set the following variable to not strictly check on the cross request authentication method:
```
env:
portal:
saml:
requested_auth: false
```
405 Method not allowed
When the browser shows a 405 Method not allowed, it basically means that the return url that is called by the SSO provider is not a POST request. You can check this my installing the SAML tracer plugin in chrome () This extension will record all requests that are send. A good procedure looks like this:\ 
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.infotopics.com/writebackextreme/features/management-console/setup-security/sso-setup/troubleshooting-sso.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.