title: Google SAML SSO - 403 app_not_configured_for_user error when signed into personal Google account
body: <p>I'm working on a SAML SSO integration for our app using Google / G Suite. Our customers configure our SAML app in their company's G Suite admin settings. The integration works correctly in most cases:</p>
  
  <ul>
  <li>Suppose you're not signed into a Google account yet. You initiate the SSO process. You're prompted to sign into your company Google account, and SSO works correctly.</li>
  </ul>
  
  <p><a href="https://i.stack.imgur.com/S6Wv7l.png" rel="noreferrer"><img src="https://i.stack.imgur.com/S6Wv7l.png" alt="google account prompt when not signed in yet"></a></p>
  
  <ul>
  <li>Suppose you're already signed into your company Google account <em>and</em> your personal Google account. You initiate the SSO process. You see an account chooser. If you choose your company Google account, SSO works correctly.
  <a href="https://i.stack.imgur.com/LApXWl.png" rel="noreferrer"><img src="https://i.stack.imgur.com/LApXWl.png" alt="account chooser prompt when signed into multiple accounts"></a></li>
  </ul>
  
  <p><strong>However, SSO fails in this case:</strong></p>
  
  <ul>
  <li>Suppose you are only signed into your personal Google account. Google does not display the account chooser. Instead, you immediately get a a 403 error: "Error: app_not_configured_for_user."</li>
  </ul>
  
  <p><a href="https://i.stack.imgur.com/OpxDgl.png" rel="noreferrer"><img src="https://i.stack.imgur.com/OpxDgl.png" alt="403 error if only signed into wrong account"></a></p>
  
  <p>This has led to a very confusing experience for our users. It's pretty common that you're currently only signed into one google account that's not your company google account. Furthermore, the error page is opaque -- it's not clear to a user what they did wrong.</p>
  
  <p>Is there any way to always show the account chooser? For example, are there any parameters we can add to the <code>/o/saml2/idp</code> url or the SAML AuthnRequest? (E.g. we tried setting <code>ForceAuthn</code> and adding a <code>&lt;saml:Subject&gt;</code> block in the AuthnRequest, but it seems Google's SAML does not support either.)</p>
  
  <p>Or is there a way for our app to get a callback on error, so we can show a more meaningful error message?</p>
  
  <p>(I contacted G Suite support, and they said to ask our question on Stack Overflow instead. Appreciate your help here!)</p>