SSO Troubleshooting

This page covers what goes wrong most often when you set up or use SSO with an organization. Each entry starts with what you see, because that is all you know when you arrive here.

Sign-in fails although the credentials are correct

Your identity provider isn't sending the user's email address in the authentication response. Ververica Cloud matches the person signing in to their Ververica Cloud account by email address, so without that claim there is nothing to match and the sign-in is rejected. The error you see can read as a credentials problem, which points you the wrong way.

Add an email claim to the client your organization uses in your identity provider, then start the sign-in again from the beginning. The failed attempt's state has already expired, so reloading the error page won't work.

SSO fails the first time anyone signs in, right after setup

When you save your SSO settings, Ververica Cloud checks that the discovery URL is reachable and returns valid content. It doesn't test the whole sign-in flow, so a wrong client ID or client secret gets through and only surfaces when someone first tries to sign in.

You aren't locked out. Sign in as the Organization Owner with a username and password: that account keeps password sign-in and reaches the organization profile and SSO settings, where you can correct the connection details and try again.

Your workspaces are missing after converting to an organization

This is expected. Workspaces move across with the account and stay listed, but they open only for people whose Team is assigned to them. Create a Team, link it to an SSO Group, and assign it to the workspace, as described in Managing Access.

Someone is in the right identity-provider group but sees no workspace

Check three things, in this order:

• The SSO Group name on the Team has to match the group name in your identity provider exactly. Nothing validates it, so a typo produces no error, just no access.
• Your identity provider has to include group membership in the authentication response.
• The person has to sign in again. An open session keeps the groups it was issued with, so a membership change made a minute ago won't apply until they do.

Domain verification stays pending

Ververica Cloud gives you a Hostname and a Key for the TXT record. The Hostname is the DNS record name and the Key is the record content; your DNS provider might label those two fields differently, and getting them the wrong way round is the usual cause.

Verification polls on its own, so there is nothing to click once the record is live. Large organizations often need a day or two to get a DNS change approved, and you can close the page and pick the setup up again later.

Sign-in redirects fail after you restarted the organization wizard

The client name Ververica Cloud generates can differ between attempts, and it forms part of the callback URL. Compare the callback URL shown in your SSO settings with the redirect URI configured in your identity provider, and update the identity provider to match. See Creating an Organization and Configuring SSO for where that value appears.