KB-2420 User Unable to Authenticate via SAML SSO With BadCredentialsException: Invalid Saml Settings

Symptoms

1. A single user or subset of users cannot authenticate to Appian through SAML SSO while other users authenticate successfully using the same SAML configuration.
2. The following line appears in the application server logs:

   INFO com.appiancorp.security.auth.saml.SamlFilter - Authentication Error: Invalid Saml settings for com.appiancorp.security.auth.saml.SamlAuthToken
   
   org.springframework.security.authentication.BadCredentialsException: Invalid Saml settings for com.appiancorp.security.auth.saml.SamlAuthToken
   
   
   
   Error while trying to authenticate the token for: SamlAuthToken [Name=user.name@example.com, Authenticated=false]

    

3. The user is directly assigned to the correct authentication group on the IdP side and receives a valid SAML assertion with correctly populated claims (NameID, username, firstName, lastName, email).

Cause

Stale SAML authentication group membership cache is present on the Appian side.

Action

1. Navigate to the Appian Admin Console and remove the impacted user from the SAML Authentication group.
2. Re-add the impacted user to the SAML Authentication group in Appian.

Affected Versions

This article applies to all versions of Appian.

Last Reviewed: October 2026