--- title: "OpenID SSO issues" slug: "openid-sso-issues" description: "Fix Azure AD SSO Login HTTP ERROR 500 by renewing the expired client secret in Entra ID and updating the SSO/IdP configuration in Document360." updated: 2026-10-23T04:55:51Z published: 2026-10-23T04:55:51Z canonical: "docs.document360.com/openid-sso-issues" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.document360.com/llms.txt > Use this file to discover all available pages before exploring further. # OpenID SSO issues If you or your users can't sign in to Document360 through OpenID Connect SSO, find the error you see below and follow the steps to fix it. Most of these errors come from a setting in your identity provider (IdP) application, so you usually fix them in your IdP, not in Document360. --- ## SSO Login Fails with HTTP ERROR 500 **Error:** During SSO login using Azure AD (Microsoft ADFS OpenID), the following error appears: > "This page is not working at the moment – identity.document360.io can't currently handle this request (HTTP ERROR 500)" **Cause** This issue occurs when the client secret configured for the Azure AD (Microsoft ADFS) SSO application has expired. As a result, the token endpoint returns a `401 Unauthorized` response during the authentication process. **Steps to resolve** 1. Sign in to the Azure portal. 2. Navigate to **Microsoft Entra ID** > **App registrations**. 3. Open the SSO application using the configured **Client ID**. 4. Go to **Certificates & secrets**. 5. Under **Client secrets**, click **New client secret**. 6. Enter a description and select the required expiry duration. 7. Click **Add**. 8. Copy the **Secret Value** immediately. Don't copy the **Secret ID**. The secret value is displayed only once. 9. In Document360, navigate to the SSO / IdP configuration. 10. Replace the existing client secret with the newly generated secret value. 11. Save the changes. 12. Test the SSO login again to confirm the issue is resolved. --- ## Sign-in fails with "Unsupported authentication method" **Error:** When you click **Login with SSO**, Document360 shows an **Oops! Something went wrong.** page with a request ID, before your IdP's login page appears. In the browser's network log, the `SSOlogin` request to `identity.document360.io` returns **500 Internal Server Error**. Your IdP's logs show the request rejected with: > `invalid_client`: Request denied: Unsupported authentication method **Cause** Your IdP application expects the client secret in an HTTP Authorization header (`client_secret_basic`). Document360 sends the client ID and secret in the request body (`client_secret_post`) and doesn't support `client_secret_basic`. If your IdP's discovery document lists a pushed authorization request (PAR) endpoint, Document360 sends the sign-in request to that endpoint before it redirects you to your IdP. Your IdP rejects that request, so the sign-in stops before the IdP login page opens. **Steps to resolve** 1. Open your IdP's discovery document in a browser: `<your Authority URL>/.well-known/openid-configuration`. 2. Check that `token_endpoint_auth_methods_supported` includes `client_secret_post`. 3. In your IdP's admin console, open the application you created for Document360. 4. Set the token endpoint authentication method to **Client Secret Post** or `client_secret_post`. For example, in PingOne, go to **Applications**, open the application, edit the **Configuration** tab and set **Token Endpoint Authentication Method** to **Client Secret Post**. 5. Save the application. 6. Sign in again from a private browser window. You don't need to change anything in Document360. Your IdP's login page opens, and you return to Document360 signed in. --- ## Failed to parse token response body as JSON **Error:** After you sign in at your IdP, Document360 shows: > An error was encountered while handling the remote login. Failed to parse token response body as JSON. Status Code: 200. Content-Type: text/html; charset=UTF-8. ![Document360 remote login error saying the token response body could not be parsed as JSON.](https://cdn.document360.io/860f9f88-412e-4570-8222-d5bf2f4b7dd1/Images/Documentation/Convert-SSO-Troubleshooting.png) **Cause** Document360 exchanges the sign-in code for a token at your IdP's token endpoint and expects a JSON response. Your IdP returned an HTML page instead. This usually happens when: - Your IdP application doesn't accept the client secret in the request body (`client_secret_post`), which is the only method Document360 supports. - The token endpoint in your IdP's discovery document redirects to another page instead of returning a token. **Steps to resolve** 1. In your IdP application, set the token endpoint authentication method to **Client Secret Post** or `client_secret_post`. 2. Open your IdP's discovery document and check that `token_endpoint` is the URL your IdP issues tokens from. 3. Save the changes in your IdP. 4. Sign in again from a private browser window. --- ## IDX20803 or IDX20807 error when you sign in **Error:** Sign-in fails with an error that starts with `IDX20803` (Unable to obtain configuration) or `IDX20807` (Unable to retrieve document). **Cause** The **Authority** in your Document360 SSO configuration isn't your IdP's issuer URL. Document360 adds `/.well-known/openid-configuration` to the Authority to find your IdP's settings. If the Authority is an endpoint, such as a URL ending in `/authorize`, Document360 can't find them. **Steps to resolve** 1. Open your IdP's discovery document in a browser and copy the `issuer` value. 2. In Document360, go to **Settings** () > **Users & Permissions** > **Enterprise SSO**. 3. Edit your OpenID Connect configuration and open the **Configure IdP** tab. 4. Paste the issuer value into the **Authority** field. For example, enter `https://auth.example.com/as`, not `https://auth.example.com/as/authorize`. 5. Click **Update**. 6. Sign in again from a private browser window. --- ## message.State is null or empty **Error:** After you sign in at your IdP, Document360 shows: > An error was encountered while handling the remote login. OpenIdConnectAuthenticationHandler: message.State is null or empty. **Cause** The Document360 sign-in redirect URL is entered in an IdP field meant for a custom login page, such as **Signon URL** in PingOne. Your IdP then skips its own login page and sends the browser straight to Document360 without an authorization code or state, so Document360 can't complete the sign-in. **Steps to resolve** 1. In your IdP's admin console, open the application you created for Document360. 2. Clear the custom login page field. In PingOne, clear **Signon URL** so that it shows **Default Signon Page**. 3. Make sure the Document360 sign-in redirect URL is entered only in the redirect URI or callback URL field. 4. Save the application. 5. Sign in again from a private browser window. --- ## If the issue persists If you still can't sign in, contact Document360 support and include: - The request ID shown on the Document360 error page. - The date, time and time zone of the failed sign-in. - The matching entry from your IdP's logs, if you can find one. - A HAR file of the sign-in attempt. To create one, see [Generating a HAR File](/help/docs/document360-support-generating-a-har-file). For setup steps, see [Other configurations with OpenID SSO](/help/docs/other-configurations-with-openid-sso). For errors that aren't specific to OpenID Connect, see [SSO login issues](/help/docs/sso-login-issues). ## Related - [SSO login issues](/sso-login-issues.md) - [ADFS with OpenID SSO](/adfs-with-openid-sso.md) - [SAML](/saml.md)