Invalid Login Credentials Error on SSO Login

When attempting to log in to Box through SSO, a user receives an Invalid login credentials error after authenticating with their company identity provider (IdP).

This usually means authentication at the IdP succeeded, but Box could not match the identity in the SAML response to a valid managed user in the target Box enterprise.

Root cause

During SSO, Box identifies the user from the email address (or login value) included in the SAML response. That value must match a managed Box user in the enterprise associated with the SSO connection. If it does not, Box returns Invalid login credentials.

Common scenarios

This same root cause can appear in several ways:

• The IdP sends a different email or login than the one stored on the Box account.
  Example: the IdP sends user@company.onmicrosoft.com, but the Box login is user@company.com.
• The user's email recently changed in the directory, but the Box account still uses the old email.
• No Box account exists for the email in the SAML response, and automatic account creation (on-the-fly / just-in-time provisioning) is not enabled.
• The email belongs to a free/external (lite) Box account, or to a user in a different enterprise.
• The SAML attribute that should contain the user email is missing, empty, or mapped incorrectly, so Box does not receive the expected login value.
  Example: Box is configured to use the SAML subject (NameID) as the login address, but the IdP places a UPN such as user@company.onmicrosoft.com in the subject and sends the actual Box login (user@company.com) in a separate email attribute. Because Box is reading the subject, it attempts to log the user in with the UPN and the login fails.

What to do

1. Confirm the affected user's login in Box Admin Console.
2. Capture a SAML trace and identify the email/login value sent to Box (NameID and/or mapped email attribute).
3. Confirm that value exactly matches a managed user login (or accepted alias) in the correct enterprise.
4. Depending on the mismatch:
   • Update the IdP attribute so it sends the Box login, or
   • Update the Box login/alias to match the value sent by the IdP, or
   • Create or roll the user into the enterprise if no matching managed user exists.
5. Retry the login after the IdP value and Box user login are aligned.

Other possible causes

SSO is not enabled for the enterprise

The user may complete IdP authentication and still see Invalid login credentials if SSO is not enabled for the enterprise.

What to do
In Box Admin Console, confirm SSO is set to Enabled or Required, as intended, then retry.

IdP-initiated login includes an unexpected RelayState

Users may succeed with SP-initiated SSO but fail with IdP-initiated SSO if the IdP-initiated login includes a RelayState that Box does not expect.

What to do

1. Test both SP-initiated and IdP-initiated login paths.
2. If only IdP-initiated login fails, review the IdP-initiated SSO configuration and remove or correct any unexpected RelayState.
3. Contact Box Support with a SAML trace from both paths if the issue continues.

Troubleshooting checklist

1. Confirm the user can authenticate successfully at the IdP.
2. Confirm SSO is enabled for the Box enterprise.
3. Capture a SAML trace and identify the email/login value sent to Box.
4. Confirm that value matches a managed Box user in the correct enterprise.
5. If only IdP-initiated login fails, review RelayState configuration.
6. Contact Box Product Support with:
   • Enterprise ID
   • Affected user email(s)
   • Approximate date/time and time zone of the failure
   • SAML trace from a failed attempt
   • Whether SSO is Enabled or Required