SSO Troubleshooting

When an SSO sign-in fails, the user sees an error page with an error code, and the organization owner sees the same code in the Test SSO report and in Organization → Activity (Single sign-on sign-in). Find the code below: each section says what it means, the usual causes, and how to fix it. The fastest way to diagnose any problem is to run Test SSO — it shows the failing check, the technical detail and every attribute your identity provider sent.

Single sign-on is not turned on SSO_NOT_ENABLED

SSO is switched off for this organization, so TestInvite does not start or accept SSO sign-ins.

Usual causes

• SSO was never turned on, or was turned off.
• Someone used the Sign-in URL of another organization.

How to fix

• Organization owner: open the SSO settings, make sure a test has passed, turn on Turn on single sign-on and Save.
• Check that the Sign-in URL contains your own organization ID.

Single sign-on is not fully set up SSO_NOT_CONFIGURED

A required value is missing: the identity provider's Entity ID, SSO URL or certificate (SAML), or the issuer, client ID or client secret (OIDC). It also appears when the response uses the other protocol than the one saved.

Usual causes

• A field was left empty.
• The OIDC client secret was never saved.
• The identity provider was switched to OIDC but TestInvite is still on SAML (or the opposite).

How to fix

• Fill in every identity provider value, run Test SSO, Save.

Organization not found ORGANIZATION_NOT_FOUND

The organization ID in the URL does not exist.

Usual causes

• A typo or an outdated link.

How to fix

• Copy the URLs again from the SSO settings screen; they contain the correct organization ID.

The identity provider reported an error IDP_ERROR

Your identity provider answered with an error instead of a sign-in (SAML status other than Success, or an OIDC error parameter). The technical detail shows the identity provider's own message.

Usual causes

• The user is not assigned to the TestInvite application.
• The application is disabled, or a conditional access / access control policy blocked the user.
• OIDC: the redirect URI or scopes are not allowed for the client (e.g. invalid_scope, unauthorized_client).

How to fix

• Check the identity provider's sign-in logs for this user (ADFS: event log; Entra ID: Sign-in logs; Okta: System Log).
• Assign the user or group to the application.
• OIDC: make sure the redirect URI is registered exactly as shown in TestInvite.

The response could not be read INVALID_RESPONSE

The SAML response is not a valid, complete SAML message, or its encrypted assertion could not be decrypted.

Usual causes

• The identity provider encrypts with a certificate that is not TestInvite's (for example an old copy of TestInvite's metadata).
• A proxy or firewall changed the response.
• The response has no assertion.

How to fix

• Re-import TestInvite's current metadata in the identity provider.
• If you do not need encryption, remove the encryption certificate from the identity provider's settings for TestInvite.

The signature is not trusted SIGNATURE_INVALID

The response or assertion is not signed, or it is signed with a certificate that is not listed in TestInvite.

Usual causes

• The identity provider renewed its signing certificate and TestInvite still has the old one (values entered by hand or uploaded as a file).
• The wrong certificate was pasted (for example the encryption certificate instead of the token-signing one).
• The identity provider is configured not to sign responses or assertions.

How to fix

• Use the identity provider's metadata URL so certificates follow automatically, or add the new token-signing certificate.
• Make sure the identity provider signs the response, the assertion, or both.
• OIDC: the ID token signature did not match the identity provider's published keys; check the issuer URL.

The response came from another identity provider ISSUER_MISMATCH

The issuer in the response is not the Entity ID / issuer configured in TestInvite.

Usual causes

• The Entity ID was typed differently (ADFS uses http://, not https://, in http://adfs.company.com/adfs/services/trust).
• Entra ID: the tenant ID in TestInvite is not the tenant the user signed in to.
• OIDC: common or organizations was used instead of the tenant ID.

How to fix

• Copy the issuer exactly from the identity provider's metadata (the technical detail shows the expected and the received value).

The response was meant for another application AUDIENCE_MISMATCH

The response is addressed to a different application than TestInvite for your organization.

Usual causes

• The identifier (Entity ID / Audience URI) in the identity provider is not TestInvite's Entity ID.
• The application was copied from another organization's setup.
• OIDC: the client ID in TestInvite is not the client that requested the token.

How to fix

• Set the identifier in the identity provider to https://www.testinvite.com/api/v1/auth/sso/<ORG-ID>/saml/metadata.
• OIDC: copy the client ID again.

The response is expired or not yet valid RESPONSE_EXPIRED

The response's validity window (NotBefore / NotOnOrAfter, or the ID token's exp / iat / nbf) does not include the current time, even allowing 3 minutes of clock difference.

Usual causes

• The identity provider server's clock is wrong.
• The sign-in page was left open for a long time and then submitted.
• The identity provider issues very short-lived responses.

How to fix

• Synchronise the identity provider server's clock (NTP).
• Start the sign-in again.

The response was not started by TestInvite UNSOLICITED_RESPONSE

The response does not answer a sign-in request that TestInvite sent in the last 15 minutes (SAML InResponseTo, OIDC nonce).

Usual causes

• The sign-in was started from the identity provider's app portal, and Allow sign-in from the identity provider portal is off.
• The user waited more than 15 minutes at the identity provider's sign-in page.
• The browser's back button re-sent an old response.

How to fix

• Point app tiles at the Sign-in URL, or turn on Allow sign-in from the identity provider portal (SAML).
• Start the sign-in again from TestInvite.

The response was already used REPLAY_DETECTED

Each SAML assertion can be used once. This one was presented before.

Usual causes

• The user refreshed the page or used the back button after signing in.
• A copy of a response was sent again.

How to fix

• Start the sign-in again. If it happens without user action, inform your security team.

The assertion was not encrypted ASSERTION_NOT_ENCRYPTED

Require encrypted assertions is on, but the identity provider sent a plain assertion.

Usual causes

• The identity provider does not have TestInvite's encryption certificate.

How to fix

• Import TestInvite's metadata in the identity provider (it contains the encryption certificate) and enable assertion encryption there — or turn the option off in TestInvite.

The sign-in could not be matched STATE_INVALID

OIDC only: the state returned by the identity provider does not match a sign-in started in the last 15 minutes. Each state can be used once.

Usual causes

• The sign-in took longer than 15 minutes.
• The callback URL was opened twice, or in another browser.
• The redirect URI belongs to another organization.

How to fix

• Start the sign-in again from TestInvite.

The OpenID configuration could not be read DISCOVERY_FAILED

TestInvite could not load <issuer>/.well-known/openid-configuration, or the document is incomplete, or its issuer is not the one you entered.

Usual causes

• A typo in the issuer URL, or a trailing path (enter the issuer, not the discovery URL).
• The identity provider is not reachable from the internet (OIDC requires it).
• The issuer uses http instead of https.

How to fix

• Open <issuer>/.well-known/openid-configuration in a browser from outside your network; the issuer value there is what TestInvite needs.

The identity provider refused to issue tokens TOKEN_EXCHANGE_FAILED

TestInvite sent the authorization code to the token endpoint and the identity provider refused it. The technical detail shows the identity provider's error (e.g. invalid_client, invalid_grant).

Usual causes

• Wrong or expired client secret (invalid_client).
• Wrong client authentication method — try Post instead of Basic, or the other way round.
• The redirect URI registered in the identity provider differs from TestInvite's (invalid_grant).
• The token endpoint is not reachable from the internet.

How to fix

• Create a new client secret, enter it in TestInvite, test and save.
• Compare the redirect URI character by character.

The ID token is not valid ID_TOKEN_INVALID

OIDC only: the ID token could not be verified for a reason other than signature, issuer, audience or time.

Usual causes

• The identity provider uses an unsupported signing algorithm, or the token is malformed.

How to fix

• Make sure the client issues signed JWT ID tokens (RS256 or ES256) and publishes its keys at the JWKS URL.

No email address was sent EMAIL_MISSING

TestInvite found no email-shaped value in the attributes or claims (with your attribute mapping), or in the NameID / subject.

Usual causes

• The identity provider sends no email attribute (ADFS: missing claim rule; Okta: no attribute statement; OIDC: email scope not granted).
• The user has no email in the directory.
• Attribute mapping points to a wrong attribute name.

How to fix

• Add the email claim rule / attribute statement in the identity provider (see the setup guide for your identity provider).
• Run Test SSO: Attributes received shows what arrived; set Email attribute to the right name.

The email domain is not allowed EMAIL_DOMAIN_NOT_ALLOWED

The email the identity provider sent is not on any of the email domains configured for SSO. The technical detail shows the domain received.

Usual causes

• A domain is missing from the list (for example a second brand domain or a subdomain).
• The identity provider sends the UPN (e.g. name@company.onmicrosoft.com) instead of the email.

How to fix

• Add the domain to Email domains, test and save.
• Make the identity provider send the real email address.

No user with this email USER_NOT_FOUND

Nobody in the organization has this email, and automatic user creation is off.

Usual causes

• The person was never added to TestInvite.
• Their TestInvite user has a different email.

How to fix

• Create the user (with this email) in TestInvite, or turn on automatic user creation.

The user is deactivated USER_INACTIVE

A user with this email exists but is deactivated.

Usual causes

• The user was deactivated on purpose.

How to fix

• Reactivate the user in TestInvite if they should have access.

Outside the access period USER_ACCESS_DENIED

The user's access start or end date excludes today.

Usual causes

• The access period has ended, or has not started.

How to fix

• Adjust the user's access dates.

More than one account uses this email DUPLICATE_IDENTITY

The email matches more than one account or user, or it is already the username of a different user, so TestInvite cannot decide who is signing in.

Usual causes

• Two users share the email (possible only before unique emails was enforced).
• A user's username equals this email while another user has it as email.

How to fix

• Make the email unique: change or remove the duplicate user.

The sign-in link expired or was used LOGIN_LINK_INVALID

After a successful check, TestInvite finishes the sign-in with a one-time link that is valid for 5 minutes. This link was expired or already used. In a test, the test itself expired (tests are valid for 24 hours).

Usual causes

• The page was reloaded or opened twice.
• The browser was very slow or the link was shared.

How to fix

• Start the sign-in (or the test) again.

Something went wrong on our side INTERNAL_ERROR

An unexpected error happened in TestInvite.

Usual causes

• A temporary problem.

How to fix

• Try again in a few minutes. If it continues, contact TestInvite support with the time of the attempt and your organization ID.

Other problems

• The Test SSO window does not open — allow pop-ups for testinvite.com and click Test SSO again.
• The identity provider shows its own error page (for example AADSTS50011 “reply URL does not match”, or ADFS “An error occurred”) — the problem is in the identity provider's settings for TestInvite; compare the ACS URL / Redirect URI and the identifier with the values in TestInvite, and check the identity provider's logs.
• Import of the metadata URL fails — the URL must start with https:// and be reachable from the internet. For identity providers inside your network, download the metadata file and use Upload metadata XML.
• A user signs in but lands as the wrong person — TestInvite matches by email; check the email in What TestInvite read in the Test SSO report.
• Saving says a test is required — a connection setting changed after the last passed test (or a new client secret was typed). Run Test SSO again, then Save.