Admin
Troubleshoot single sign-on
Find the message or symptom you are seeing, and the fix for it.
Last updated: September 2026
While setting it up
| You see | What to do |
|---|---|
| No Single sign-on (SSO) section on the Security tab | Single sign-on needs the Professional plan. Check it under Billing. |
| An email domain is already used by another organization | Each domain can belong to only one LambdaAssetCheck organisation. Remove it, or contact support if it should be yours. |
| At least one email domain is required | Add your team's work domain under Email domains, without the @. |
| Client secret is required | Paste the secret from your identity provider's app. It is stored encrypted and shown masked afterwards. |
| Identity provider sign-in failed after Test connection | Check the Client ID, Client secret and Issuer URL, then your redirect URI. |
| Google rejected this app's OAuth request | In Google Cloud, the OAuth client must be a Web application, with the redirect URI copied exactly from the Security tab. |
| The test passes, but nobody sees Continue with SSO | Their email domain is not listed under Email domains, or they have not been invited. |
When someone signs in
| They see | What to do |
|---|---|
| No account found for this email | They have not been invited, or their email at your identity provider differs from the one they were invited with. Invite them with that exact address. |
| Your sign-in session expired | Signing in through the provider has to finish within about 10 minutes. Start again from the sign-in page. |
| Invalid sign-in response or Could not start single sign-on | Start again from the sign-in page. If it keeps happening, check the provider settings above. |
| Single sign-on is not enabled for this organization | An administrator has turned SSO off, or the organisation has left Professional. Sign in with a password, or use Forgot password. |
| Password is refused, and Continue with SSO never appears | Their email is not on a listed SSO domain. They should sign in with a password (or Forgot password). Listing their domain is only needed if you want them on SSO. |
| No password field, and SSO fails | Require SSO is on, and their email is on a listed domain. Fix the provider settings above, or contact support. |
Check your redirect URI
Most setup failures are a redirect URI that is almost right. The one at your identity provider must match the value on the Security tab character for character:
- the same
https://— nothttp:// - the same domain, exactly as people type it in the browser
- ending in
/api/auth/sso/callback, with nothing after it
Copy it from the Security tab rather than typing it.
Related articles
Was this page helpful?
