Problem

When logging in to the Everbridge Member Portal using Single Sign-On (SSO), a Contact is redirected to the Single Sign-On login page with the following error in the URL:

Error internal_validation_error

Root Cause

The most common root cause is that the Contact's SSO User ID in Everbridge does not match what is in the site's identity provider (IdP) configuration for that Contact. Either there is a mismatch, the User ID is missing, or there is no active Contact record for the Contact having the issue.

Member SSO can also fail if:

• The Contact does not have the required permissions or access in the IdP.

• The SSO metadata between Everbridge and the IdP is out of date or mismatched.

• The Member Portal configuration is incorrect.

• SSO certificates in the IdP or Everbridge configuration have expired or are not current.

Solution

1. Confirm the Contact exists within the Organization and that the Contact record is active.

2. Confirm that the Contact record has an SSO User ID.

3. Check the SAML response and compare the NameID value in the XML to the SSO User ID in the Contact or User profile to ensure the values match. See knowledge article EBS: Capturing a SAML Response When Logging Into Everbridge Suite via Single Sign-On (SSO) for information on how to capture the SAML response.

4. Confirm that the SSO User ID in the Contact record matches what is in the IdP configuration. SSO User IDs are case-sensitive and MUST match exactly.

5. If there is a mismatch in the SSO User ID between the IdP and Everbridge, update the Contact record in Everbridge. Everbridge Technical Support cannot make this change for you.

6. Ensure you are using the correct login URL for your Organization's Member Portal.

7. Verify that the SSO configuration is saved correctly at the Organization level:

   • Navigate to Settings > Security > Single Sign-On Member Portal.

   • Select the Member Portal checkbox under Manage Single Sign-On Settings.

   • Confirm the correct target service/application is registered with CAS (if applicable) in your SSO configuration.

   • Click Save at the bottom.

   • Download the Everbridge metadata file and upload it to your identity provider to confirm the configuration and metadata are current.

   • Verify that any SSO certificates used in the IdP and in Everbridge are valid and not expired.

8. Clear your browser's cookies and cache before attempting to log in again, or try an incognito/private browsing window or a different supported browser.

9. If you are using an on-premises ADFS IdP, confirm with your IT team that the user has the correct permissions and that the Everbridge SSO metadata has been refreshed recently.

If you still cannot resolve the problem, contact Everbridge Support and provide the email address used for SSO and the approximate time and date of the failed login attempt for further investigation.