Kelderby: SAML test login fails for Moerdijk depot
Description
Hi,
we set up one depot's application in our Entra ID test tenant first, to learn how it works: Moerdijk, our smallest depot, not one of the seven pilots. The test login fails at Microsoft before it reaches you:
AADSTS50011: The reply URL specified in the request does not match the reply URLs configured for the application.
Screenshot attached. What did we get wrong?
Henrik
Linked issues
- relates to SUP-964 Kelderby: do we really need 25 applications in Entra ID? Done
- relates to SUP-956 Kelderby: organisation set-up (EU region, 25 depots) Done
- relates to SUP-1088 Kelderby test tenant: 'audience mismatch' again, on four new test applications Done
- relates to SUP-1096 Kelderby: can we upload the SAML metadata ourselves? Done
Comments (6)
Our side sends Moerdijk's own reply URL (…/kelderby/mdk/acs). The screenshot of their app shows …/kelderby/rot/acs: the Rotterdam row of our sheet. Easy to do; the sheet lists all 25 depots in one table.
Found it: each depot has its own reply URL (the Assertion Consumer Service URL), and Moerdijk's application has Rotterdam's. In Entra ID:
Enterprise applications → Moerdijk app → Single sign-on → Basic SAML configuration → Reply URL
should be https://id.acme-hq.example/saml/kelderby/mdk/acs. The Identifier stays as it is.
I'll change the sheet so each depot is one row with all three values, instead of three tables. Rotterdam is on line 1, people copy it.
Fixed, test user gets in. Sorry for the copy-paste.
No problem, it's a common one. We see the Moerdijk test sign-in at 15:52 on our side. Closing.
Hi Henrik, thanks for the screenshot. That error comes from Entra ID, so it's in the application's settings. Looking at what we sent you now.