Common SSO setup errors

SSO configuration errors

Check the following settings if Fundraise Up cannot verify your SSO configuration:

• Invalid identity provider URL: Check that the Identity provider URL matches the SAML endpoint in your IdP metadata. Do not use the IdP administration page URL.
• Incorrect Issuer ID: Check that Issuer ID matches the entityID in your IdP metadata exactly.
• Invalid SAML message format or unexpected IdP response: Ask your IT administrator to review the IdP’s SAML configuration and response.
• Authentication issues: Check your IdP credentials and complete any additional authentication steps required by your organization.
• Connection timeout: Check that the IdP is available and that network, firewall, or proxy settings do not block the connection.
• Missing required attributes: Ask your IT administrator to check that the SAML response includes the attributes required by the SSO configuration.
• Unsupported signature method: Verify that the signature method used by your IdP is supported by Fundraise Up. The following signature algorithms are supported:
  • RSA-SHA1
  • RSA-SHA256
  • RSA-SHA384
  • RSA-SHA512
  • DSA-SHA1
  • DSA-SHA256
  • ECDSA-SHA1
  • ECDSA-SHA256
  • ECDSA-SHA384
  • ECDSA-SHA512

Certificate validation errors

If you see “issue in validating certificate,” check the following:

• The Issuer ID, Identity provider URL, and certificate come from the same IdP application and metadata file.
• The certificate has not expired and matches the certificate used by the IdP to sign the SAML response.
• The certificate is complete and does not contain extra spaces or hidden characters.
• The metadata file displays in full. Open the XML in a text editor if your browser does not show the complete certificate.

If validation still fails, try pasting only the base64‑encoded certificate body, without the -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- lines. Re-enter the settings and click Verify.

Contact Fundraise Up Support if the metadata values match and the certificate is complete and unexpired, but verification still fails.

SSO conflict with another account

You may see an error stating that SSO cannot be set as required because an email address is already using SSO authentication in another account. This error can also appear when enabling Optional SSO.

The conflict may concern the email domain, not the named user’s membership. Another Fundraise Up account may have verified the same domain and enabled SSO with a different issuer.

Ask your IT administrator to coordinate SSO settings across the affected accounts:

• Use the same SAML issuer and IdP application for accounts that share an email domain.
• Use separate email domains if the accounts need different SAML configurations.

Contact Fundraise Up Support if you do not know which account has the conflicting configuration.

SSO login errors

The following errors can prevent login even after you configure SSO.

“Failed to open callback window” in Safari

Safari may block the pop-up window required for SSO before you reach the IdP login page.

To allow the authentication window:

1. Open dashboard.fundraiseup.com in Safari.
2. Open the Safari settings for the website.
3. Set Pop-up Windows to Allow for dashboard.fundraiseup.com.
4. Refresh the page and click Continue with SSO again.

Microsoft Entra error AADSTS50105

This error means that Microsoft Entra requires an application assignment, but the user does not have access directly or through an assigned group.

Ask your Microsoft Entra administrator to assign the user or an appropriate group to the Fundraise Up enterprise application, then try logging in again.

Domain verification errors

If you see “DNS not configured correctly,” check the following:

• All fields in the DNS record match the values Fundraise Up provides.
• The record is added to the correct domain. Use “@” to represent the root domain only if your DNS provider requires it.
• The DNS changes have propagated. This can take up to 48 hours in some cases.
• The public DNS record contains the expected values. Your IT administrator can check it using a tool such as nslookup or dig.

Contact Fundraise Up Support if verification still fails after you check the record and allow time for DNS propagation.