Since approximately 08:30 AM PDT on April 4, 2026, approximately 340 users across Engineering, Finance, and Legal departments have been experiencing intermittent failures when authenticating through the corporate Single Sign-On (SSO) system. Affected users report receiving "Authentication failed — please try again" errors after entering valid credentials on the corporate identity portal (sso.corp.example.com). The issue appears intermittent: roughly 30–40% of login attempts fail on the first try, with subsequent retries succeeding within 2–3 attempts.

The corporate SSO stack uses Okta as the primary Identity Provider (IdP), backed by Active Directory (AD) federation via ADFS on two on-prem servers (ADFS-PROD-01 and ADFS-PROD-02). Affected applications include Salesforce, Jira, Workday, and the internal HR portal. VPN-authenticated sessions appear unaffected; only browser-based SAML flows are impacted.

Initial triage shows elevated 500-series error rates from ADFS-PROD-01 beginning at 08:28 AM (correlation with a scheduled maintenance window for SSL certificate renewal). ADFS-PROD-02 is healthy. Okta logs show intermittent SAML assertion signing errors from ADFS-PROD-01. No changes were made to the Okta tenant configuration in the past 14 days. The scheduled maintenance completed at 08:15 AM; however the certificate trust store on ADFS-PROD-01 may not have been reloaded correctly.

Caller has confirmed that manually forcing Okta to route all SAML requests to ADFS-PROD-02 as a temporary load-balancing override did reduce the error rate significantly, but this is not a sustainable fix and full load distribution must be restored. A permanent resolution is needed before the end-of-day SLA window.