If you or your team are getting an "Invalid samlResponse" error while trying to access Snappy, don't panic. This is a common hiccup that happens when the way you log in doesn't quite match up with Snappy's security settings.
This article will explain exactly why this error happens - breaking down the difference between SP-initiated and IdP-initiated logins using a simple analogy - and provide a ready-to-send template you can give your IT team to resolve the issue for good.
The Simple Explanation
Think of Snappy like a secure building:
SP-Initiated (The Right Way): The user goes to the Front Door. The building says, "I don't know you; go get a key from your IT department." The user gets the key, returns to the front door, and is let in.
IdP-Initiated (The Error): The user tries to use a Back Door. They get a key from their IT dashboard first and then just "show up" at the building.
The Problem: Because the building is set to "Front Door Only," it refuses to accept any keys it didn't specifically ask for. When it sees an "unsolicited" key, it gets confused and displays the "Invalid samlResponse" error.
How to Fix It
Send this message to your IT team:
Subject: Action Required: Update SSO Tile Configuration for Snappy
The "Invalid samlResponse" error occurs because the user is attempting an IdP-Initiated login (e.g., clicking a tile directly within Okta or Azure).
For security reasons, our platform is configured exclusively for Service Provider (SP)-Initiated login. To resolve this, please update the "Sign-on URL" or "App Tile" link in your IdP dashboard to point to our login gateway instead of the generic ACS URL:
Correct Tile Link:
https://login.snappy.com/login/SSO?ssoName=[Insert_Your_SSO_Name_Here]
*The SSO ^ name should be unique to the user. If my company name isRabbit Security, I should choose a name likerabbit_security
Using this URL ensures the session is properly initialized by Snappy before the user authenticates.