Appearance
Troubleshooting SSO
Available onEnterprise
Start with the exact message. Messages from Infyva appear on the Infyva sign-in page or the Sign-in did not finish page. Messages with codes like AADSTS50011 come from your identity provider.
Messages while setting up
| Message | Cause | Fix |
|---|---|---|
| The page shows Enterprise plan, Single sign-on and a Talk to sales button | Your workspace isn't on Enterprise | Contact sales |
| Set up single sign-on with Coming soon | SSO isn't switched on for your workspace yet | Email support@infyva.ai |
| Only workspace owners can change the identity provider, domains or sign-in rules. | You are an admin, not the owner | Ask the owner, or have ownership transferred |
| That file is too large for IdP metadata. | The file is over 512 KB | Download the metadata for this one app, not the whole federation |
| That file doesn't look like SAML IdP metadata. Download the metadata XML from your identity provider. | Wrong file, such as a certificate | Download the IdP metadata XML |
| That URL didn't return SAML IdP metadata. | The URL is a sign-in page, not metadata | Copy the metadata URL from your provider's app |
| The discovery URL didn't return an OpenID configuration. | The URL isn't the provider's discovery document (it ends in /.well-known/openid-configuration), or the document has no issuer, authorization endpoint, token endpoint or JWKS URI | Use the provider's discovery URL |
| Metadata URL: ... or Discovery URL: ... | Infyva couldn't fetch the address: it doesn't start with https://, isn't on a public host, or answered with an error | Read the detail after the colon and use the public https URL from your provider |
| Your identity provider details were not accepted: ... | The sign-in service rejected the metadata or settings | Read the detail after the colon, fix it in your provider, and save again |
| We couldn't find the TXT record for <domain> yet. | DNS hasn't published, or the name or value is wrong | Check the record with the Copy values, wait, then Check now |
| <domain> is a personal email provider and can't be used for SSO. | A public mailbox domain was entered | Use your company domain |
| One of these domains is already used for SSO by another workspace. | Another workspace verified it | Contact support@infyva.ai |
| You can add up to 10 domains. | Limit reached | Remove a domain you don't use |
| Require SSO is greyed out | Nobody has signed in with SSO yet | Test sign-in first |
Messages while signing in
| Message | Cause | Fix |
|---|---|---|
| Enter your work email above, then choose Sign in with SSO. | The email field was empty | Type your work email first |
| Single sign-on is not set up for this email. Sign in with your password instead. | The email's domain isn't verified for SSO, or SSO is off | Check the domain under 2 Verify your email domain, and that Allow sign-in with SSO is on |
| Your workspace requires single sign-on. Use "Sign in with SSO" instead. | Require SSO is on and a password was used | Click Sign in with SSO |
| Your identity provider reported: ... | The provider returned an error | Read the provider's message and see the provider table below |
| Your identity provider did not complete the sign-in. Please try again. | The provider sent no email address | Map the email attribute or claim (see your provider's guide) |
| <email> is not on a verified domain for this workspace. | The email the provider sent is on another domain | Verify that domain, or send the person's work address |
| This identity provider is not linked to that workspace. | The response came from a connection that was replaced | Start again from the sign-in page |
| The sign-in response was incomplete. Please start again from the sign-in page. | The sign-in response came back without the details Infyva sent, for example after a refresh | Start again from the Infyva sign-in page. Sign-in from your provider's app tile is not supported. |
| This sign-in was started in a different browser or tab. Please start again from the sign-in page. | The sign-in finished in another browser, tab or private window | Start and finish in the same tab |
| This sign-in link has expired or is invalid. Please start again. | More than 10 minutes passed at the provider | Start again |
| This sign-in link was already used. Please start again from the sign-in page. | The back button or a refresh replayed the sign-in | Start again |
| Single sign-on is no longer enabled for this workspace. | SSO was switched off during the sign-in | Ask the owner |
| Your account is suspended. Contact your workspace admin. | The account is suspended in Infyva | An admin can reactivate it in Team and roles |
| This account belongs to a different workspace. | The email is already a member of another Infyva workspace | Contact support@infyva.ai |
| This account type can't join a workspace through single sign-on. | The email belongs to a candidate account | Use a different work address, or contact support |
Provider errors
| Provider error | Usual cause | Fix |
|---|---|---|
| Entra AADSTS50011 | Reply URL or redirect URI doesn't match | Paste Infyva's value again. Microsoft |
| Entra AADSTS700016 | Entity ID or client ID doesn't match the tenant | Paste the Entity ID or client ID again. Microsoft |
| Entra AADSTS50105 | Person not assigned to the app | Assign them. Microsoft |
| Entra AADSTS7000215 or AADSTS7000222 | OIDC client secret wrong or expired | Create a new secret and save it in Infyva |
| Okta: user is not assigned to the client application | Person not assigned | Assign them on the app's Assignments tab |
| Okta: redirect_uri must be a Login redirect URI | Redirect URI mismatch | Paste Infyva's Redirect URL again |
| Google 403 app_not_configured_for_user | Entity ID mismatch, or app off for the person | Check the Entity ID and User access. Google |
Still stuck
Email support@infyva.ai with the exact message, the time you tried, and the provider you use. Successful and failed SSO sign-ins to your workspace are listed in your audit log.