Testing and Troubleshooting SSO

Overview

Once you've configured SSO between CX Platform and your identity provider (IdP) — like Okta or Azure AD — it's worth putting it through its paces before letting your users loose on it. A smooth SSO experience means people sign in once and get on with their work; a broken one means support tickets, locked-out users, and confused logins.

Testing covers the everyday scenarios (valid logins, logouts, password changes) as well as the edge cases (network blips, expired sessions, dodgy certificates). And when something does go wrong, knowing where to look — logs, certificates, attribute mapping — saves hours of guesswork.

This guide walks you through the test cases worth running and the troubleshooting techniques that'll get you back on track quickly.

‍

Before you start
‍Have your IdP admin console open in another tab. You'll want quick access to logs, user records, and certificate settings while you work through these tests.

‍

Key SSO testing steps

Run through these tests in order. Each one isolates a specific part of the SSO flow, so if something fails you'll know roughly where to look.

Test with a valid user

Sign in to CX Platform using a user with valid credentials in your SSO identity provider.
Confirm the user lands in CX Platform without being prompted for a second password.
Check that they have access to the apps and modules they're entitled to.

If this works, your core SSO handshake is healthy and your attribute mapping is sending the right user through.

‍

Test with invalid credentials

Attempt a sign-in with the wrong username or password at the IdP.
Confirm that access is denied and a clear error message is shown.

You want this to fail gracefully. A blank screen or a cryptic error here is a sign your error handling needs work.

‍

Test session management

Sign in as a user and open another SSO-linked app in the same browser session.
Confirm the second app loads without asking you to sign in again. That's the whole point of SSO.
Click Log out in one of the linked apps.
Switch to the other app and confirm that session has also ended.

If you're still logged in to the other app after signing out, your Single Logout (SLO) configuration needs a closer look.

‍

Test password changes and expiry

Change a user's password at the identity provider.
Try signing in to CX Platform with the old password and confirm it's rejected.
Sign in again with the new password and confirm access is restored across all SSO-linked apps.

This confirms that CX Platform is genuinely checking with the IdP each time, rather than caching credentials.

‍

Test across browsers and devices

SSO behaviour can vary between browsers, especially around cookies and pop-up handling. Run your core sign-in test in:

Chrome, Firefox, Edge, and Safari
Desktop, tablet, and mobile
At least one private or incognito window, to rule out cached sessions skewing your results

‍

Test error and timeout handling

This is where you simulate the things that go wrong in the real world. Try:

Dropping your network connection mid sign-in
Letting a session sit idle until it expires, then trying to use the app
Sending an invalid or malformed SAML response (your IdP admin can usually help with this)

In every case, the user should see a clear, actionable message — not a stack trace or a generic "something went wrong".

‍

Common troubleshooting techniques

When something's not working, start by narrowing down where in the flow it's failing. The table below covers the most common issues and where to look.

Issue	Where to look
SSO/SAML logs	Your first port of call. Review SAML assertions and audit logs at the IdP and on CX Platform side. You're looking for failed handshakes, clock mismatches between servers, expired or untrusted certificates, and misconfigured endpoints. Most SSO problems leave a clear footprint in the logs if you know where to look.
Certificate or endpoint issues	Check that the signing certificates on CX Platform and your identity provider match exactly and haven't expired. Also confirm your login and logout URLs are identical on both sides — even a trailing slash difference can break the handshake. Certificate rotations are a common cause of SSO suddenly stopping work after months of running fine.
Invalid user attributes	SSO depends on the IdP sending the right user details across in the SAML response. Confirm the required attributes — typically email, username, and any role mappings — are being sent and that CX Platform is mapping them to the right fields. Missing or misnamed attributes will let the handshake succeed but leave the user without proper access.
Session or cookie issues	If users are getting stuck in redirect loops or being asked to sign in repeatedly, inconsistent session handling is often the culprit. Ask the user to clear their cookies or test in a private browser window. If it works there, you've narrowed the problem down to stale session data.
Error handling	Test how the system responds to missing SAML assertions, unauthorised users, and malformed responses. Users should never see a generic error — every failure path should have a message that tells them what happened and what to do next. If you're seeing unclear errors, that's a configuration gap worth closing.

‍

Best practices

A few habits that'll save you time and headaches down the line:

Test with both new and existing users. A fresh user with no cached sessions behaves differently to one who's been signing in for months.
Keep a standard set of test cases. Valid login, invalid login, logout, role update, expired session, password change. Run them after every SSO change.
Keep records. Save your test results and SAML traces. If you ever need support to help diagnose an issue, those traces are gold.
Re-test after IdP changes. Certificate rotations, attribute schema updates, or policy changes at the IdP can all break SSO without warning.

One last thing

Always run your tests in a non-production environment first where possible. Pushing an SSO change straight to production and finding out it doesn't work is a quick way to lock everyone out at once.

That's it — work through these tests and you'll have a clear picture of how your SSO setup is performing, plus a head start on diagnosing anything that's not behaving as expected.