Troubleshooting
When SSO fails, the login page shows a message, and its URL carries a code:
/login?sso_error=<code>.
Error codes
sso_error | Message | Cause → fix |
|---|---|---|
sso_tenant_required | Single sign-on must be started from your workspace URL. | You're on waxell.dev. Use https://<workspace>.waxell.dev/login. |
sso_provider_missing | That single sign-on provider is no longer configured. | The provider was deleted or disabled. Check Settings → Identity. |
sso_unsupported_protocol | That single sign-on provider is not supported yet. | Use OIDC or SAML. |
sso_state_mismatch | Your sign-in session expired. Please try again. | More than 10 minutes passed between Continue with SSO and the IdP's response, or the response was replayed. Start again from the login page. (A SAML provider's IdP-initiated sign-in also needs Allow sign-in from the IdP's app launcher.) |
sso_session_expired | Your sign-in session expired. Please try again. | Start again from the login page. |
sso_provider_error | Your identity provider rejected the sign-in. | The IdP refused, for example the user isn't assigned to the app. Check the IdP's sign-in logs. |
sso_exchange_failed | Could not complete sign-in with your identity provider. | OIDC: wrong client secret or redirect URI, or the Issuer URL doesn't match the IdP's exactly. SAML: the response wasn't valid, usually the wrong signing certificate. |
sso_missing_subject | Your identity provider did not return an account identifier. | OIDC: the IdP sent no sub. SAML: no Name ID. |
sso_missing_email | Your identity provider did not return an email address. | SAML: set the Name ID to the email, or add an email attribute. Entra cloud-only users: use user.userprincipalname. |
sso_email_unverified | Your email is not verified with your identity provider. | OIDC: the IdP reported email_verified: false or didn't send it. Microsoft Entra: use SAML. |
sso_domain_not_allowed | Single sign-on is not configured for your email domain. | Add the user's domain to the provider's Email domains. |
sso_no_account | No Waxell account exists for that email. Ask your workspace admin to invite you. | No account and Create accounts on first sign-in is off. Turn it on, or invite them. |
sso_not_a_member | You are not a member of this workspace. | They have a Waxell account, but not in this workspace. Turn on account creation, or invite them. |
sso_account_disabled | This account is disabled. | The account was deactivated (for example by offboarding). |
sso_email_verification_required | Verify your email address before signing in. | The workspace requires verified emails; the user hasn't verified theirs. |
Other problems
"No single sign-on provider is configured for your email domain" after Continue with SSO: no enabled provider in this workspace lists that domain. Check Email domains and Enabled.
There's no "Continue with SSO" button. SSO is only offered on a workspace URL
(<workspace>.waxell.dev), not on waxell.dev.
Group mapping didn't apply. The mapping's team must exist in this workspace; group names can't contain spaces; and Entra sends group IDs, not names. See group mapping.
Test says Failed. OIDC: Waxell couldn't read
<issuer>/.well-known/openid-configuration, so check the Issuer URL. SAML: a
required field is empty, or the certificate isn't valid.
Locked out with SSO enforced. Use the owner recovery link.