Google SAML SSO - 403 app_not_configured_for_user error when signed into personal Google account

Question

I'm working on a SAML SSO integration for our app using Google / G Suite. Our customers configure our SAML app in their company's G Suite admin settings. The integration works correctly in most cases:

Suppose you're not signed into a Google account yet. You initiate the SSO process. You're prompted to sign into your company Google account, and SSO works correctly.

Suppose you're already signed into your company Google account and your personal Google account. You initiate the SSO process. You see an account chooser. If you choose your company Google account, SSO works correctly.

However, SSO fails in this case:

Suppose you are only signed into your personal Google account. Google does not display the account chooser. Instead, you immediately get a a 403 error: "Error: app_not_configured_for_user."

This has led to a very confusing experience for our users. It's pretty common that you're currently only signed into one google account that's not your company google account. Furthermore, the error page is opaque -- it's not clear to a user what they did wrong.

Is there any way to always show the account chooser? For example, are there any parameters we can add to the /o/saml2/idp url or the SAML AuthnRequest? (E.g. we tried setting ForceAuthn and adding a block in the AuthnRequest, but it seems Google's SAML does not support either.)

Or is there a way for our app to get a callback on error, so we can show a more meaningful error message?

(I contacted G Suite support, and they said to ask our question on Stack Overflow instead. Appreciate your help here!)

user_378648 · Answer

Instead of redirecting to directly from your app to the Google IDP, you need to redirect to https://accounts.google.com/accountchooser?continue={theredirectURL}

See Google SAML app_not_configured_for_user / equivalent of prompt=select_account SAML

user_13927912 · Answer

if you using a passport-saml There is a fork that fixes this behavior.
Set in configuration googleAuth: true and then during authorization there will be a redirect to the google account selection page

user_450694 · Answer

I had this same issue. When I then added the G suite account to my Android device under Settings > Accounts and retried the login flow, I was properly prompted with the Account Chooser. Not the solution I was really looking for, but it did change the outcome.

user_2162591 · Answer

I had the exact same problem when working with Keeper Password Manager. I solved it by erasing everything from ~/Library/Application Support/Keeper Password Manager/Cookies

I suggest you look for a similar folder in your app and do the same

Google SAML SSO - 403 app_not_configured_for_user error when signed into personal Google account

4 Answers