Every SSO engineer has had this week. An integration is configured, tested and signed off in a lower environment. It gets promoted and within hours of go-live, tickets start arriving: users who can't reach the application, an application team that insists nothing on their side has changed, and a business stakeholder asking why a working integration broke.
Nothing broke. The integration was never tested against the conditions it now runs in.
I spent close to two years configuring and supporting enterprise SSO leveraging protocols such as SAML 2.0, OAuth 2.0 and OIDC through PingFederate and PingAccess in a large regulated banking environment. What struck me over that time is how few post-go-live failures were actually protocol failures. The assertions were well-formed. The flows were correct. The failures came from somewhere else: real user data, and configuration that arrived from other people.
This is a walk through the failure modes I saw repeatedly, with the symptom, the cause, and how to confirm it.
1. The directory holds something other than what you tested against
