Error 400 Malformed or illegal request while logging into ArcGIS Online using Google workspace

Error Message

SAML Login has been successfully configured for ArcGIS Online using Google Workspace. However, while attempting the SSO login to ArcGIS Online account without being previously signed into Google workspace account, results in and error similar to the following:

Error 400
Your client has issued a malformed or illegal request.

Cause

This error can occur when the ‘Enable signed request’ and ‘Allow Encrypted Assertion’ settings are enabled while configuring SAML login for ArcGIS Online using Google workspace. ArcGIS Online does not require these settings for successful SSO authentication with Google workspace, and enabling them can result in incompatibility during the login handshake, leading to a failed SSO login.

Solution or Workaround

1. Log in to the ArcGIS Online organization account as an administrator.
2. Navigate to Organization > Settings > Security.
3. Under Security, scroll down to the Logins section and click Configure login for the specific SAML login.

4. In the Advanced settings disable the Enable signed request and Allow Encrypted Assertion settings, as shown in the next image.

5. Click Save and sign out of ArcGIS Online.
6. Access the ArcGIS Online organization URL again and click the Google Signin option shown in the image below.

7. A successful redirect to the Google sign-in page allows using the Google email ID and password.