Cloud · Single sign-on · 09
Troubleshoot single sign-on
Failed test sign-ins, expiring certificates, and people who can't sign in.
This page covers the problems people hit most with single sign-on, from a failed test sign-in to an organization that can't sign in at all. If yours isn't here, contact support with the connection's name and what you tried.
The email your provider sent isn't on your domain
Cause. A connection only signs in people with an address on its domain. Your provider sent a different address, often a user principal name or a personal address, or none.
Fix. In your provider, make the email attribute carry the person's address on your domain, or change the Email attribute in Cloud's Attributes step to one that does. Then choose Test again.
The test sign-in didn't finish
Cause. The window was closed, the sign-in took too long, or you signed in another way, such as with a password, instead of at your provider.
Fix. Choose Test again and sign in at your identity provider with your own work account. To test someone else's account, use a test link in a private window: see Test a connection.
The identity provider sent back an error
Cause. Your provider refused the sign-in, often because the person isn't assigned to the Zym Labs app, or the Reply URL or Entity ID doesn't match.
Fix. Check the person is assigned to the app, and that the values in your provider match the Configuration on the connection's page in Cloud.
The signing certificate is expiring
Cause. Your provider's SAML signing certificate has an end date. Cloud warns you 30 days before.
Fix. If the connection uses a metadata URL, renew the certificate in your provider and Cloud picks it up. If you uploaded a metadata file, upload the new one with Edit settings before the date, or people can't sign in.
Cloud couldn't read the connection's metadata
Cause. Cloud checks each connection's metadata URL once a day, and it didn't respond or changed.
Fix. Open the URL yourself. If it's moved, update it with Edit settings.
Nobody can sign in
Cause. Single sign-on is required, and your identity provider is down or set up wrong.
Fix. An owner signs in with a passkey, or a password and their second step: owners keep one for this. If no owner can, contact support.
What's next
- How single sign-on works: connections, stages and certificates.
- Test a connection: check a fix.