> ## Documentation Index
> Fetch the complete documentation index at: https://braintrust.dev/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Okta SAML tile login fails with missing RelayState

> Troubleshoot the missing RelayState error when signing in to Braintrust from an Okta tile with SAML SSO.

export const plans_0 = "Enterprise"

export const deployments_0 = "Any"

export const data_plane_version_0 = undefined

export const use_case_0 = "Use case - Enterprise users with Okta SAML SSO who can sign in from Braintrust directly but see a missing RelayState error from an Okta tile"

<Note>
  **Applies to:**

  * Plan - {plans_0}
  * Deployment - {deployments_0}
  * {data_plane_version_0}
  * {use_case_0}
</Note>

## Summary

**Issue:** Users can sign in from [braintrust.dev](https://www.braintrust.dev), but clicking the Braintrust tile in Okta fails with `RelayState parameter is missing from the SAML Response` or `saml_response_relaystate_missing`.

**Cause:** This can happen when IdP-initiated login has not been enabled for the Braintrust SAML connection. Other SAML configuration issues can produce similar Okta tile failures, so verify the direct Braintrust login path before changing Okta settings.

**Resolution:** Contact Braintrust support and ask them to verify that IdP-initiated login is enabled for your SAML connection.

## Resolution steps

### Step 1: Confirm the error

Check whether the failing Okta tile flow returns an error like:

```json theme={"theme":{"light":"github-light","dark":"github-dark-dimmed"}}
{
  "errors": [
    {
      "message": "RelayState parameter is missing from the SAML Response",
      "code": "saml_response_relaystate_missing"
    }
  ]
}
```

### Step 2: Compare with direct Braintrust sign-in

Go directly to [braintrust.dev](https://www.braintrust.dev) and sign in with SSO.

* If direct sign-in works but the Okta tile fails, ask Braintrust support to verify the IdP-initiated login setting for your SAML connection.
* If direct sign-in also fails, continue troubleshooting the broader SAML setup, including the metadata URL, identity provider issuer, certificate, email domain, and user assignment.

### Step 3: Ask Braintrust support to verify IdP-initiated login

Open a support ticket and include:

* The identity provider you use, such as Okta Workforce.
* The affected email domain.
* A screenshot or copy of the missing RelayState error.
* Whether direct sign-in from [braintrust.dev](https://www.braintrust.dev) succeeds.

Braintrust support will check the SAML connection and enable IdP-initiated login if needed.

### Step 4: Test the Okta tile again

After support confirms the SAML connection update, refresh Okta and try the Braintrust tile again.

## Temporary workaround

If users need access before the Okta tile is fixed, have them sign in from [braintrust.dev](https://www.braintrust.dev) directly.

## Notes

* Do not assume this error requires changing the Okta Default RelayState value. Braintrust support should verify the SAML connection settings first.
* If users see `saml_email_address_domain_mismatch`, follow the [SAML domain mismatch troubleshooting guide](/kb/saml-login-fails-with-email-domain-mismatch) instead.