Press CTRL+K to open search

OpenID SSO issues

  • Updated on Oct 23, 2026
  • Published on Jun 3, 2026
  • 4 minute(s) read
Prev Next

If you or your users can't sign in to Document360 through OpenID Connect SSO, find the error you see below and follow the steps to fix it. Most of these errors come from a setting in your identity provider (IdP) application, so you usually fix them in your IdP, not in Document360.

SSO Login Fails with HTTP ERROR 500

Error:
During SSO login using Azure AD (Microsoft ADFS OpenID), the following error appears:

"This page is not working at the moment – identity.document360.io can't currently handle this request (HTTP ERROR 500)"

Cause

This issue occurs when the client secret configured for the Azure AD (Microsoft ADFS) SSO application has expired. As a result, the token endpoint returns a 401 Unauthorized response during the authentication process.

Steps to resolve

  1. Sign in to the Azure portal.
  2. Navigate to Microsoft Entra ID > App registrations.
  3. Open the SSO application using the configured Client ID.
  4. Go to Certificates & secrets.
  5. Under Client secrets, click New client secret.
  6. Enter a description and select the required expiry duration.
  7. Click Add.
  8. Copy the Secret Value immediately. Don't copy the Secret ID. The secret value is displayed only once.
  9. In Document360, navigate to the SSO / IdP configuration.
  10. Replace the existing client secret with the newly generated secret value.
  11. Save the changes.
  12. Test the SSO login again to confirm the issue is resolved.

Sign-in fails with "Unsupported authentication method"

Error:
When you click Login with SSO, Document360 shows an Oops! Something went wrong. page with a request ID, before your IdP's login page appears. In the browser's network log, the SSOlogin request to identity.document360.io returns 500 Internal Server Error. Your IdP's logs show the request rejected with:

invalid_client: Request denied: Unsupported authentication method

Cause

Your IdP application expects the client secret in an HTTP Authorization header (client_secret_basic). Document360 sends the client ID and secret in the request body (client_secret_post) and doesn't support client_secret_basic.

If your IdP's discovery document lists a pushed authorization request (PAR) endpoint, Document360 sends the sign-in request to that endpoint before it redirects you to your IdP. Your IdP rejects that request, so the sign-in stops before the IdP login page opens.

Steps to resolve

  1. Open your IdP's discovery document in a browser: <your Authority URL>/.well-known/openid-configuration.
  2. Check that token_endpoint_auth_methods_supported includes client_secret_post.
  3. In your IdP's admin console, open the application you created for Document360.
  4. Set the token endpoint authentication method to Client Secret Post or client_secret_post. For example, in PingOne, go to Applications, open the application, edit the Configuration tab and set Token Endpoint Authentication Method to Client Secret Post.
  5. Save the application.
  6. Sign in again from a private browser window.

You don't need to change anything in Document360. Your IdP's login page opens, and you return to Document360 signed in.

Failed to parse token response body as JSON

Error:
After you sign in at your IdP, Document360 shows:

An error was encountered while handling the remote login. Failed to parse token response body as JSON. Status Code: 200. Content-Type: text/html; charset=UTF-8.

Document360 remote login error saying the token response body could not be parsed as JSON.

Cause

Document360 exchanges the sign-in code for a token at your IdP's token endpoint and expects a JSON response. Your IdP returned an HTML page instead. This usually happens when:

  • Your IdP application doesn't accept the client secret in the request body (client_secret_post), which is the only method Document360 supports.
  • The token endpoint in your IdP's discovery document redirects to another page instead of returning a token.

Steps to resolve

  1. In your IdP application, set the token endpoint authentication method to Client Secret Post or client_secret_post.
  2. Open your IdP's discovery document and check that token_endpoint is the URL your IdP issues tokens from.
  3. Save the changes in your IdP.
  4. Sign in again from a private browser window.

IDX20803 or IDX20807 error when you sign in

Error:
Sign-in fails with an error that starts with IDX20803 (Unable to obtain configuration) or IDX20807 (Unable to retrieve document).

Cause

The Authority in your Document360 SSO configuration isn't your IdP's issuer URL. Document360 adds /.well-known/openid-configuration to the Authority to find your IdP's settings. If the Authority is an endpoint, such as a URL ending in /authorize, Document360 can't find them.

Steps to resolve

  1. Open your IdP's discovery document in a browser and copy the issuer value.
  2. In Document360, go to Settings () > Users & Permissions > Enterprise SSO.
  3. Edit your OpenID Connect configuration and open the Configure IdP tab.
  4. Paste the issuer value into the Authority field. For example, enter https://auth.example.com/as, not https://auth.example.com/as/authorize.
  5. Click Update.
  6. Sign in again from a private browser window.

message.State is null or empty

Error:
After you sign in at your IdP, Document360 shows:

An error was encountered while handling the remote login. OpenIdConnectAuthenticationHandler: message.State is null or empty.

Cause

The Document360 sign-in redirect URL is entered in an IdP field meant for a custom login page, such as Signon URL in PingOne. Your IdP then skips its own login page and sends the browser straight to Document360 without an authorization code or state, so Document360 can't complete the sign-in.

Steps to resolve

  1. In your IdP's admin console, open the application you created for Document360.
  2. Clear the custom login page field. In PingOne, clear Signon URL so that it shows Default Signon Page.
  3. Make sure the Document360 sign-in redirect URL is entered only in the redirect URI or callback URL field.
  4. Save the application.
  5. Sign in again from a private browser window.

If the issue persists

If you still can't sign in, contact Document360 support and include:

  • The request ID shown on the Document360 error page.
  • The date, time and time zone of the failed sign-in.
  • The matching entry from your IdP's logs, if you can find one.
  • A HAR file of the sign-in attempt. To create one, see Generating a HAR File.

For setup steps, see Other configurations with OpenID SSO. For errors that aren't specific to OpenID Connect, see SSO login issues.

Related articles