IdP-Initiated login is not enabled for connection error when SP-Initiated flow configured

[jmadison]

We have IdP-Initiated logins disabled on purpose so getting the error is fine. The problem we are trying to solve is why we are getting the error in the first place.

We are configured with an SP-Initiated flow and Auth0 documentation says we can get the “IdP-Initiated login is not enabled for connection” error when in SP-Initiated flow if 1) the RelayState is missing or empty or 2) the InResponseTo attribute in the SAML Response is missing or empty.

I checked the Auth0 log entry and see both the RelayState and the InResponseTo attribute in the SAML Response. Neither are missing or empty, so the SP-Initiated flow should be fine.

Does anyone know why an SP-Initiated flow with both RelayState and InResponseTo attributes set, would cause the “IdP-Initiated login is not enabled” warning?

[ben.tennant]

I’m having this same issue working with Azure AD as the IdP. Were you able to resolve this issue?

[emmafo]

Were you able to resolve?

[ctauxe]

I am having this problem as well.

There’s an older thread here which I think may be the same issue: False IdP-Initiated login when Testing SAML Connection with Custom Domain

Unfortunately, it looks like its a bug for Auth0, but not a high-priority fix.

Edit: Found another thread about this issue:

SAML SSO using Auth0 as service and identity provider login fails due to IdP initiated login

Problem statement We have been running with Auth0 acting as a SAML service provider in production for a few months with no issues. The IdP is Okta, and the Auth0 connection is called “okta-saml” in our tenant. Users log in through the web application and are redirected to Okta by Auth0. We never perform “IdP initiated login” and thus have disabled this option. We are now integrating with a partner application using SAML, and we want to use Auth0 as our IdP. Our SAML integration with this partn…

[ctauxe]

I believe people are encountering this issue because, if you are using a Custom Domain, then Auth0’s guide for setting up SAML (HERE) will mislead you into getting this error.

So to clarify on the docs:
If you are using a Custom Domain, when you copy the AssertionConsumerService/Location out of your tenant’s metadata, you must replace the domain there with your Custom Domain. Then copy that into the Application Callback URL field of the IdP Tenant in the next step.