Clinic MFP authentication loop — SSO certificate mismatch (service mode fix)

Joe B.

Reviewed for technical accuracy

Specialities: MFPs, SSO/SAML/OIDC, Azure AD/LDAP, Certificates, Print Management

Clinic MFP SSO loop — certificate expired/mismatch, trust chain, time skew, LDAP/Azure AD/IdP redirect

Technician

Hey! We’ll stop the MFP authentication loop caused by an SSO certificate mismatch. A few quick questions to target the fix:
• What model/MFP brand and which IdP do you use (Azure AD/Entra, ADFS, Okta, Ping)?
• Is the device using an embedded app like PaperCut MF/Equitrac/uniFLOW for SSO?
• Did the loop start after renewing the server certificate, changing the redirect URL, or a recent NTP/time change?

Customer

It’s a Konica Minolta MFP at a clinic. Users badge or type PIN, it redirects to our Azure AD login and then bounces back to the start — endless sign-in loop. We recently replaced the AAD certificate.

Technician

Got it. In clinics we often see loops when the MFP can’t validate the IdP’s TLS chain or when CN/SAN names don’t match the redirect URL. Other triggers: an expired intermediate, time skew > 5 minutes (SAML assertion not yet valid), or the device using outdated TLS 1.0/1.1 settings.
Plan: 1) Enter service mode. 2) Import the correct root + intermediate certs and verify trust. 3) Regenerate/assign the MFP’s own HTTPS certificate if needed. 4) Clear the embedded app cache and re-register with the IdP.

Customer

We can get into admin but not user mode. Where exactly is service mode and what should we export/import?

Technician

Step 1 — Enter service mode
Use the vendor’s sequence to enter Service/Administrator mode (varies by model). Open Security → Certificates/PKI.
Step 2 — Load the IdP trust chain
From an admin PC, download your IdP’s root CA and all intermediate CAs (PEM/DER). On the MFP, import them into the Trusted CA store. If Azure AD uses a proxy or custom domain (e.g., login.company.com), ensure the MFP trusts the full chain for that hostname.
This fixes the classic SSO certificate mismatch / “server not trusted” that causes redirect loops.

Customer

The device also has its own HTTPS certificate. Could that cause the loop?

Technician

Yes. Some embedded SSO apps and secure pull-print solutions validate the MFP’s own HTTPS certificate when exchanging tokens. If the CN/SAN doesn’t match the device URL (FQDN) or the cert expired, the app can re-start auth.
Step 3 — Regenerate/assign device cert
Create a CSR on the MFP with the FQDN (e.g., mfp-rx1.clinic.local) in SAN. Sign it with your internal CA or add a vendor cert. Install and set as the active HTTPS certificate.

Customer

Time could be off. We had NTP issues last week. Would a few minutes matter?

Technician

Absolutely. Time skew breaks SAML/OIDC because tokens have NotBefore/NotOnOrAfter windows. If the MFP’s clock differs by > 5 minutes, it looks invalid and you get a redirect loop.
Step 4 — Sync time
In service mode, set a reachable NTP server and verify timezone/DST. Also confirm TLS 1.2 is enabled and weak ciphers disabled if the IdP enforces modern policies.

Customer

We use PaperCut MF for badge login. Anything specific to the embedded app?

Technician

Yes. After fixing certificates/time:
• Clear the embedded app cache (PaperCut Device → Reset authentication / re-pair).
• Update the redirect URI / SP entity ID so it matches Azure AD.
• If LDAP-over-SSL is used for fallback, ensure the LDAP server certificate and chain are trusted on the MFP.
• Re-register the device with the server and test badge → login → release.

Customer

Users still get bounced when they use guest Wi-Fi or VPN. Could the proxy be involved?

Technician

Likely. Ensure the MFP can reach your IdP endpoints (login.microsoftonline.com or custom domain), token/graph URLs, and OCSP/CRL distribution points for certificate validation. Bypass SSL-inspection for the MFP subnet or install the proxy’s root CA in the device trust store. Otherwise the device sees a different cert and repeats the SSO loop.

Customer

After importing the Azure intermediate and fixing NTP, badge login works. Any final checks so it stays fixed?

Technician

Final checks:
• Renew reminders for IdP and device certificates (90-day notice).
• Lock the MFP to approved NTP, enable TLS 1.2, and store the complete trust chain.
• Keep the embedded app updated; confirm redirect URIs/entity IDs after any domain change.
If you like, I can stay on and verify OCSP/CRL reachability and token lifetimes.

Customer

Looks good — no more SSO loop on the clinic MFP. Thanks!

Technician

Summary: Clinic MFP authentication loop after an IdP change usually means SSO certificate mismatch or time skew. Enter service mode, import the IdP’s root + intermediate CAs, renew the MFP’s HTTPS cert (correct CN/SAN), enable TLS 1.2, sync NTP, then clear and re-register the embedded app. Need help? Open the chat.

Quick answer: the accepted fix

Accepted fix for a Clinic MFP SSO authentication loop: in service mode import the IdP’s root and intermediate certificates, regenerate and apply the MFP’s HTTPS certificate with correct CN/SAN, enable TLS 1.2, and sync NTP. Then clear the embedded app cache (PaperCut/Equitrac/uniFLOW), confirm redirect URI / entity ID, and re-register the device.

FAQ

Step-by-step (service mode)

1. Enter Service/Administrator mode → Security/PKI.
2. Import IdP root and intermediate CAs; verify the chain for the login hostname.
3. Regenerate/apply the MFP’s HTTPS certificate with correct CN/SAN (FQDN).
4. Enable TLS 1.2; disable legacy protocols if the IdP requires it.
5. Configure NTP and sync time; confirm timezone/DST.
6. Clear embedded app cache (PaperCut/Equitrac/uniFLOW) and re-register with the IdP; verify redirect URI/entity ID.

Note for mixed environments (macOS)

1. For macOS release stations, ensure the server trusts the same root/intermediate CAs.
2. If using CUPS with Kerberos/LDAP, verify ticket times and certificate trust to avoid cross-platform loops.

Sources

• Microsoft — Certificates and trust for Azure AD/Entra
• Microsoft — Configure SSO and redirect/identifier settings
• Microsoft — SSL certificate requirements and rollover

Matt ● replies in < 1 min

Technician Expert

⭐⭐⭐⭐⭐ Trusted by 27,000+ customers

Alex · Expert's Assistant

Send Message →

2 Tech Support Specialists are online right now.