Book a demo
Sign Up
Organization Single Sign-On (SSO)

Testing Your SSO Connection

Test SSO runs a real sign-in against unsaved settings and reports every check, the attributes received and the user it would resolve to — without signing anyone in, creating users or changing anything; SSO can only be turned on after a passed test.

Updated 2026/10/19

Test SSO lets you prove that your identity provider and TestInvite understand each other before anyone depends on it. It runs the real sign-in, performs every security check, and tells you exactly what happened — but signs nobody in, creates no user, links no account and changes no setting. People already using SSO are not affected while you test.

How to run a test

  1. Fill in the SSO settings (protocol, identity provider values, email domains, attribute mapping). You do not need to save first.
  2. Click Test SSO in section 5. A small window opens. If nothing opens, allow pop-ups for testinvite.com and click again.
  3. Sign in there with a company account whose email is on one of your domains. If you are already signed in to your identity provider, this may happen without any prompt.
  4. The window closes by itself and the report appears under the button (usually within a few seconds).
  5. When the test has passed, turn on Turn on single sign-on and click Save.
A test is valid for 24 hours and only for the settings it ran with. Changing a connection setting (identity provider values, domains, attribute mapping, client secret) shows “Settings changed since the last passed test”; run the test again before saving.

Reading the report

The top of the report says Test passed or Test failed. A failed test shows the error code, a one-sentence explanation and a How to fix link to the matching section of SSO Troubleshooting. A passed test says what the sign-in would do: sign in as the organization owner, sign in as an existing user, or create a new user.

Checks

Checks run in order. When one fails, the rest show Not checked.

CheckProtocolWhat it verifies
Response receivedbothYour identity provider returned a readable response without an error
Request match (state)OIDCThe answer belongs to the sign-in TestInvite started (state)
OpenID configurationOIDCThe discovery document was read and its issuer matches
Token exchangeOIDCYour identity provider accepted the client ID / secret and returned an ID token
SignaturebothSigned by a certificate you configured (SAML) or a key your identity provider publishes (OIDC)
IssuerbothIssued by the identity provider you configured
Intended application (audience)bothAddressed to TestInvite for your organization
Time windowbothNot expired and not issued in the future (3 minutes of clock difference allowed)
Started by TestInvitebothAnswers a request TestInvite sent (SAML InResponseTo / OIDC nonce)
EncryptionSAMLOnly when Require encrypted assertions is on: the assertion was encrypted
Not a replaySAMLThe assertion was not used before
Email foundbothAn email-shaped value was found using your attribute mapping
Email domain allowedbothThe email is on one of your SSO domains
User resolvedbothThe email leads to the owner, one existing user, or a new user (automatic user creation on); the user is active and within access dates

What TestInvite read, and Attributes received

What TestInvite read shows the email and name after attribute mapping. Attributes received lists every attribute or claim your identity provider sent, with its values; click an attribute name to copy it. Use this list to set up Attribute mapping when automatic detection picks the wrong value. Technical detail shows the validator's own message for a failed check — include it when asking your identity provider team for help.

Before going live: what to test

☐
A person who already has a TestInvite user with the same email → signs in as the existing user.
☐
A person with no TestInvite user → a new user would be created (automatic user creation on), or USER_NOT_FOUND (off) — whichever you intended.
☐
The organization owner's company account → signs in as the organization owner (if the owner's email is on your domain).
☐
A name with non-English characters (ç, ğ, ı, ö, ş, ü…) arrives correctly in What TestInvite read.
☐
A person who should not have access (not assigned in the identity provider) is stopped by the identity provider.

Tip: the test window uses this browser's sign-in to your identity provider. To test as a different person, sign out of your identity provider in this browser first (keep TestInvite open), then run the test and sign in as that person.

Go back