SSO troubleshooting - Odin

When an SSO sign-in fails, Odin returns the person to the sign-in page with a message. Use this page to find the cause.

Message	Cause	Fix
Your identity provider did not return an email address.	The assertion or token has no `email` claim	SAML: add an `email` attribute (Okta: `email` = `user.email`). OIDC: request the `email` scope and make sure the user has an email.
The email returned by your identity provider is not allowed for this organisation.	The email’s domain is not a verified domain on the connection, the connection is disabled, or directory sync removed this person	Check the user’s email in the IdP, the connection’s domains and status, and whether the person is still assigned in your directory
Your identity provider reports that this email address is not verified.	The IdP sent `email_verified` = `false`	Verify the email in the IdP. On Auth0, turn off public sign-ups for the connection used with Odin.
Single Sign-On is required for this organisation.	Mandatory SSO is on and the person tried a one-time code, passkey, Google or GitHub	Sign in by entering the work email and selecting Continue with email, which goes to your IdP
Your organisation has no free seats.	A new person signed in through SSO, but your organisation’s fixed seat limit is reached	Add seats in Billing, or remove someone in Team Management
Your organisation adds people to Odin through its identity provider, and you have not been added yet.	Only directory-provisioned people can join is on and your directory has not provisioned this person	Assign the person to the provisioning app in your IdP and wait for it to sync, or invite them in Team Management
Too many requests. Please try again later.	Too many sign-in attempts for the same email in a short time	Wait a few minutes and try again
Sign-in callback failed. Please try again.	The SSO service rejected the response, for example because the signature does not match the metadata, or the audience or ACS URL is wrong	Re-check the values in your IdP. If the IdP rotated its signing certificate, reconfigure Odin with the new metadata.

Problems before reaching Odin

Symptom	Cause	Fix
The IdP says the user is not assigned to the application	The person has no access to the Odin app in your IdP	Assign the person or one of their groups
Keycloak says Invalid requester	The client requires signed authentication requests	Turn off Client signature required on the client’s Keys tab
Odin sends the person to a one-time code instead of the IdP	The domain is not on an active connection, or the email has a typo	Check the connection is Active and includes the domain
Microsoft Entra users get not allowed for this organisation although their email is correct	Entra left the email claim out because the domain is not verified in your Entra tenant, so Odin received the `…onmicrosoft.com` sign-in name	Add an explicit `email` claim. See the Entra guide.
An error page appears after signing out with Microsoft Entra ID	The Entra app has a Logout Url set	Clear the Logout Url. Entra then shows its own signed-out page.
A list of identity providers appears instead of your IdP	An older connection from before a reconfiguration is still registered	Open Reconfigure and save the current connection again; Odin removes the older one

Signing out

Symptom	Cause	Fix
After signing out of Odin, the next sign-in does not ask for a password	Your IdP still has a session. Normal for OIDC and for IdPs without SAML single logout.	Sign out of the IdP too, or set up single logout on Okta
The IdP shows an error after signing out of Odin	The IdP did not accept Odin’s logout request (Auth0, Keycloak)	Turn off single logout in the IdP. The Odin session has already ended.

Directory sync

Symptom	Cause	Fix
A person in the directory does not appear in Odin	Their email is not on a verified domain, or the directory is paused	Verify the domain or invite them manually; select Enable to resume the directory, which catches up automatically
Roles do not match IdP groups	Directory manages roles is off, the group is not pushed to Odin, or its name differs from the mapping	Turn the setting on, push the group from the IdP and check the group name under Roles
A role changed by hand reverted	Directory manages roles is on, so the directory decides roles	Change the person’s groups in the IdP, or turn the setting off
A person assigned in the IdP does not appear in Odin, and the directory is active	Your organisation’s seat limit is reached	Add seats, then select Pause and Enable on the directory to add the people who were skipped
The bearer token is lost	Odin only shows it once	Remove the directory, create a new one, and update the IdP
Not saved. These role settings would remove your own admin access.	You are not in the mapped admin group	Add yourself to that group in the IdP, or turn off Directory manages roles
Admins became Members after saving role settings	They are not in the mapped admin group	Add them to the admin group in the IdP, then select Save role settings
Entra provisioning fails for every request	The directory was created as Microsoft Entra ID SCIM 2.0 before Odin handled Entra automatically	Remove it and create it again with the same provider, then update the Entra token

Still stuck? Contact [email protected] with the time of the attempt and the email used. Do not send SAML responses, tokens or screenshots containing secrets.