Synthesia

Common issues faced when attempting to login in with SSO:

Paywall: After following the steps to login with SSO, the user sees options to buy Synthesia. This means the user is not part of the workspace: either it is a new user or the email of the user provided by Azure AD is not the one already in used. Invite the user to the workspace.

Blocked by Admin: After following the steps to login with SSO, a message is displayed from Azure AD indicating an error and that it is blocked by Admin. To log in to Synthesia, the user needs to be added in the relevant group in Azure AD. Ask your IdP (Azure AD) administrator to add you in.

Redirection to app.synthesia.io with an error: After following the steps to login with SSO, the user is redirected to <a href="https://app.synthesia.io/" rel="nofollow noopener noreferrer" target="_blank">app.synthesia.io</a> with a SAML error. Ask your IdP (Azure AD) administrator to check that:

- The <code>NameID</code> is set in lower case. If not done already, apply a lower case function.
- The email claim has to be available with the attribute <code>email</code> .

1. Paywall: After following the steps to login with SSO, the user sees options to buy Synthesia. This means the user is not part of the workspace: either it is a new user or the email of the user provided by Azure AD is not the one already in used. Invite the user to the workspace.
2. Blocked by Admin: After following the steps to login with SSO, a message is displayed from Azure AD indicating an error and that it is blocked by Admin. To log in to Synthesia, the user needs to be added in the relevant group in Azure AD. Ask your IdP (Azure AD) administrator to add you in.
3. Redirection to app.synthesia.io with an error: After following the steps to login with SSO, the user is redirected to <a href="https://app.synthesia.io/" rel="nofollow noopener noreferrer" target="_blank">app.synthesia.io</a> with a SAML error. Ask your IdP (Azure AD) administrator to check that:
 - The <code>NameID</code> is set in lower case. If not done already, apply a lower case function.
 - The email claim has to be available with the attribute <code>email</code> .

___________________________________________________________

Troubleshooting Steps to Retrieve IdP Response in a HAR file:

Open your browser and navigate to the page where you are experiencing the issue.

Open the Developer Tools panel and select the Network tab at the top.

Check the box for Preserve log to ensure all network activity is recorded.

Perform the login attempt as you normally would.

Look for a network request labeled with idpresponse in the list of network activity. This is the key request we need to verify the configuration.

Right-click on the idpresponse request in the Network tab.

Select Save all as HAR with content from the context menu.

1. Open your browser and navigate to the page where you are experiencing the issue.
2. Open the Developer Tools panel and select the Network tab at the top.
3. Check the box for Preserve log to ensure all network activity is recorded.
4. Perform the login attempt as you normally would.
5. Look for a network request labeled with idpresponse in the list of network activity. This is the key request we need to verify the configuration.
6. Right-click on the idpresponse request in the Network tab.
7. Select Save all as HAR with content from the context menu.
8. Save the file to your computer.

Troubleshooting Steps to Analyze the IdP Response:

Use the Filter bar in the Network tab to search for idpresponse.

Select the correct request and response from the filtered results.

Go to the Payload section of the request.

Click View Source to see the full payload.

Copy the content of the payload and paste it into <a href="https://samltool.io" rel="nofollow noopener noreferrer" target="_blank">samltool.io</a>.

In the SAML response, check the following:

1. NameID is in lowercase.
2. Email attribute is present.

1. Use the Filter bar in the Network tab to search for idpresponse.
2. Select the correct request and response from the filtered results.
3. Go to the Payload section of the request.
4. Click View Source to see the full payload.
5. Copy the content of the payload and paste it into <a href="https://samltool.io" rel="nofollow noopener noreferrer" target="_blank">samltool.io</a>.
6. In the SAML response, check the following:
 1. NameID is in lowercase.
 2. Email attribute is present.

If you still face issues logging in with SSO after trying the above troubleshooting steps, reach out to <a href="mailto:support@synthesia.io" rel="nofollow noopener noreferrer" target="_blank">Synthesia Support Team</a> for assistance.

When reaching out to the support team please prove the following information:

HAR file containing the idpresponse for analysis.

The exact URL used to log in to the system.

List of Users who are able to log in successfully and a list of users who are unable to log in.

A screenshot of the SAML configuration that shows:

- Email is provided
- The NameID is in lowercase.

1. HAR file containing the idpresponse for analysis.
2. The exact URL used to log in to the system.
3. List of Users who are able to log in successfully and a list of users who are unable to log in.
4. A screenshot of the SAML configuration that shows:
 - Email is provided
 - The NameID is in lowercase.

This information will help the support team understand your setup and expedite the troubleshooting process.

- To learn more about SSO configuration with Synthesia see the <a href="https://docs.synthesia.io/docs/synthesia-sso-guide" rel="nofollow noopener noreferrer" target="_blank">Synthesia SSO guide</a>.

Notes: