SSO login broken: pre-release and first 30 minutes checklists

Single sign-on fails after an identity provider, certificate or callback URL change.

The pre-release checklist maps each item to a test class from the incident page. The first-30-minutes checklist covers detection, containment, the rollback decision and customer communication.

5 pre-release items · 7 first-30-minutes items · verified 2026-10-21

Pre-release checklist

PR-01Assert that the redirect_uri sent in the SAML init request, including host and query string, matches the value registered for each test tenant. e2e
PR-02Run the SSO login test against one tenant per identity provider configuration type in use by customers, not only the internal tenant. e2e
PR-03Replay the new SAML request, including any new service provider certificate, against each identity provider configuration type and confirm none rejects it. e2e
PR-04Run any new certificate validation rule against the stored certificates of all customer tenants in report-only mode, and block enforcement while any current customer certificate fails. e2e
PR-05Schedule a synthetic SAML login every few minutes for each identity provider configuration type and alert on the first failure. synthetic

First 30 minutes

FM-01Group incoming SSO failure reports by identity provider configuration and error text, such as redirect mismatch or invalid signature.
FM-02Match the time of the first report against the deploy log for changes to the SAML init request, certificates or certificate validation.
FM-03Revert the SSO change if the failures cluster on one change, since the reports restored login by reverting.
FM-04Confirm that password or other login methods still work and point affected users to them where the tenant allows it.
FM-05Run a test SSO login for one affected tenant after the revert to confirm that the redirect and signature checks pass.
FM-06Post a status update naming SAML SSO as the affected login method and the identity provider configurations involved.
FM-07Tell customers if they need to update the service provider certificate on their identity provider, and give the deadline.

Download the checklist

Pre-release checklist (Markdown)1.2 KB · v1.0.0
First 30 minutes checklist (Markdown)1.2 KB · v1.0.0

Only in this checklist

Every test class in this checklist also appears in at least one sibling checklist in the group; the item texts differ: Assert that the redirect_uri sent in the SAML init request, including host and query string, matches the value registered for each test tenant.

Questions

What should be checked before a release to prevent SSO login broken?

5 pre-release items, PR-01 to PR-05. PR-01: Assert that the redirect_uri sent in the SAML init request, including host and query string, matches the value registered for each test tenant.

Is there a rollback plan for SSO login broken?

The first-30-minutes checklist has 7 items. FM-01: Group incoming SSO failure reports by identity provider configuration and error text, such as redirect mismatch or invalid signature.

What should a team do in the first 30 minutes after SSO login broken is detected?

The first-30-minutes checklist has 7 items. FM-01: Group incoming SSO failure reports by identity provider configuration and error text, such as redirect mismatch or invalid signature.

Is a SSO login broken checklist still needed if deployment is automated?

Yes. Automation runs the steps; the checklist names what the tests must cover: end-to-end tests and synthetic monitoring.

Which pipeline stages does the SSO login broken checklist cover?

The pre-release items map to the pre-deploy and post-deploy stages.

In what formats can the SSO login broken checklist be downloaded?

Both checklists download as Markdown files: /downloads/sso-login-broken-pre-release.md and /downloads/sso-login-broken-first-30-minutes.md, licensed CC BY 4.0.