Sign in
Catalog / Hands-on lab

Lab: Debug a broken federation

Your own Monosign v2026.10 server with a SAML application and a partner identity provider that both fail for real. Read the errors and the audit log, fix each fault in Monosign and prove the fix with a real sign-in.

Monosign University Pass 1 hIntermediate DE · EN · ES · TR Administrator Architect

Version 5 · updated Nov 11, 2026What changed?

Hands-on lab
Sign in to start

Included with University Pass.

What you will learn

  • Apply a systematic troubleshooting method to SAML and inbound federation failures
  • Rotate a partner's signing certificate without interrupting sign-in

Your lab environment

YOUR LAB SERVERYour browserAdmin, then test sign-ins in aprivate windowManagementSAML Settings, Partnerprovider, audit logDirectoryfiona in FIN- and othergroups, partner usersAccountSign-in, routespartner.example to PartnerExpense PortalLab SAML app, lists thesign-ins it receivedPartner identity providerpaula, peter, petra; sendsemail, names, deptFixes and verifiesInbound SAML
Your lab environment: Monosign is the identity provider for the Expense Portal and a service provider for the partner, and both trusts are broken

Lab tasks

Each task is checked automatically against the real state of your lab environment.

  1. 1. Find why Monosign refuses the Expense Portal's sign-in and correct the registered address, with ACS validation left on Enforce
  2. 2. Fix the NameID so the Expense Portal identifies fiona by a stable identifier, not her e-mail address
  3. 3. Send only fiona's finance groups to the Expense Portal, in an attribute named groups, and sign in successfully
  4. 4. Restore sign-in through the partner by trusting its new signing certificate, then sign in as [email protected]
  5. 5. Make just-in-time provisioning fill Department from the partner's dept attribute, and prove it with a partner user who has never signed in