> ## Documentation Index > Fetch the complete documentation index at: https://docs.borghq.io/llms.txt > Use this file to discover all available pages before exploring further. # SSO troubleshooting > What single sign-on error messages mean and how to fix them When an SSO sign-in fails, Odin returns the person to the sign-in page with a message. Use this page to find the cause. ## Messages on the Odin sign-in page | Message | Cause | Fix | | - | - | - | | *Your identity provider did not return an email address.* | The assertion or token has no `email` claim | SAML: add an `email` attribute (Okta: `email` = `user.email`). OIDC: request the `email` scope and make sure the user has an email. | | *The email returned by your identity provider is not allowed for this organisation.* | The email's domain is not a verified domain on the connection, the connection is disabled, or directory sync removed this person | Check the user's email in the IdP, the connection's domains and status, and whether the person is still assigned in your directory | | *Your identity provider reports that this email address is not verified.* | The IdP sent `email_verified` = `false` | Verify the email in the IdP. On Auth0, turn off public sign-ups for the connection used with Odin. | | *Single Sign-On is required for this organisation.* | [Mandatory SSO](/platform/sso/mandatory-sso) is on and the person tried a one-time code, passkey, Google or GitHub | Sign in by entering the work email and selecting **Continue with email**, which goes to your IdP | | *Your organisation has no free seats.* | A new person signed in through SSO, but your organisation's fixed seat limit is reached | Add seats in [Billing](/platform/billing#seats), or remove someone in [Team Management](/platform/team-management) | | *Your organisation adds people to Odin through its identity provider, and you have not been added yet.* | [Only directory-provisioned people can join](/platform/sso/directory-sync#access) is on and your directory has not provisioned this person | Assign the person to the provisioning app in your IdP and wait for it to sync, or invite them in Team Management | | *Too many requests. Please try again later.* | Too many sign-in attempts for the same email in a short time | Wait a few minutes and try again | | *Sign-in callback failed. Please try again.* | The SSO service rejected the response, for example because the signature does not match the metadata, or the audience or ACS URL is wrong | Re-check the [values in your IdP](/platform/sso/set-up#values-for-your-identity-provider). If the IdP rotated its signing certificate, reconfigure Odin with the new metadata. | ## Problems before reaching Odin | Symptom | Cause | Fix | | - | - | - | | The IdP says the user is not assigned to the application | The person has no access to the Odin app in your IdP | Assign the person or one of their groups | | Keycloak says *Invalid requester* | The client requires signed authentication requests | Turn off **Client signature required** on the client's **Keys** tab | | Odin sends the person to a one-time code instead of the IdP | The domain is not on an active connection, or the email has a typo | Check the connection is **Active** and includes the domain | | Microsoft Entra users get *not allowed for this organisation* although their email is correct | Entra left the email claim out because the domain is not verified in your Entra tenant, so Odin received the `…onmicrosoft.com` sign-in name | Add an explicit `email` claim. See the [Entra guide](/platform/sso/identity-providers#microsoft-entra-id). | | An error page appears after signing out with Microsoft Entra ID | The Entra app has a **Logout Url** set | Clear the **Logout Url**. Entra then shows its own signed-out page. | | A list of identity providers appears instead of your IdP | An older connection from before a reconfiguration is still registered | Open **Reconfigure** and save the current connection again; Odin removes the older one | ## Signing out | Symptom | Cause | Fix | | - | - | - | | After signing out of Odin, the next sign-in does not ask for a password | Your IdP still has a session. Normal for OIDC and for IdPs without SAML single logout. | Sign out of the IdP too, or set up [single logout](/platform/sso/identity-providers#single-logout) on Okta | | The IdP shows an error after signing out of Odin | The IdP did not accept Odin's logout request (Auth0, Keycloak) | Turn off single logout in the IdP. The Odin session has already ended. | ## Directory sync | Symptom | Cause | Fix | | - | - | - | | A person in the directory does not appear in Odin | Their email is not on a verified domain, or the directory is paused | Verify the domain or invite them manually; select **Enable** to resume the directory, which catches up automatically | | Roles do not match IdP groups | **Directory manages roles** is off, the group is not pushed to Odin, or its name differs from the mapping | Turn the setting on, push the group from the IdP and check the group name under **Roles** | | A role changed by hand reverted | **Directory manages roles** is on, so the directory decides roles | Change the person's groups in the IdP, or turn the setting off | | A person assigned in the IdP does not appear in Odin, and the directory is active | Your organisation's seat limit is reached | Add seats, then select **Pause** and **Enable** on the directory to add the people who were skipped | | The bearer token is lost | Odin only shows it once | Remove the directory, create a new one, and update the IdP | | *Not saved. These role settings would remove your own admin access.* | You are not in the mapped admin group | Add yourself to that group in the IdP, or turn off **Directory manages roles** | | Admins became Members after saving role settings | They are not in the mapped admin group | Add them to the admin group in the IdP, then select **Save role settings** | | Entra provisioning fails for every request | The directory was created as **Microsoft Entra ID SCIM 2.0** before Odin handled Entra automatically | Remove it and create it again with the same provider, then update the Entra token | Still stuck? Contact [mail@borghq.io](mailto:mail@borghq.io) with the time of the attempt and the email used. Do not send SAML responses, tokens or screenshots containing secrets. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.