Skip to main content
Find the problem you’re seeing, then work through its fixes in order. Your identity provider’s (IdP’s) sign-in logs, such as the System Log in Okta or the sign-in logs in Microsoft Entra ID, usually show why a sign-in failed.

​
Setup problems

The wizard lists the errors when a test fails.
  • Make sure you’re assigned to the Ravenna application in your IdP. The test signs you in as yourself.
  • Compare the connection details in the wizard with your IdP, such as the client ID and secret, metadata URL, or signing certificate. Copy them again if they don’t match.
  • Keep the wizard tab open while the test runs.
If a connected integration syncs user profiles, click Next on the Claims Mapping step without adding claims. See Configure your identity provider.

​
Sign-in problems

The user isn’t assigned to the Ravenna application in your IdP. Ravenna shows the error message from your IdP, or “Access denied. Please contact support.”
  • Assign the user, or a group they belong to, to the Ravenna application in your IdP.
  • Check that the user’s account in your IdP is active.
Ravenna sends users to your IdP when their email domain belongs to your organization. If the user belongs to more than one Ravenna organization, Ravenna may use the last organization they signed in to instead.
  • Check that the user entered their work email, not a personal one.
  • Have the user sign in with your organization’s direct SSO login URL, which skips the email step.
Your organization enforces SSO-only sign-in, so Google sign-in is off. Users see Authentication Error with the message “Access forbidden”.Have users enter their work email on the login page and click Continue, or use the direct SSO login URL.
Something changed in your IdP, or your IdP is unavailable.
  • Check your IdP’s status page and sign-in logs.
  • If your provider uses SAML, check whether its signing certificate has expired, and replace the certificate.
  • If someone changed the Ravenna application in your IdP, such as its client secret or URLs, edit the connection to match.
  • If no admin can sign in to Ravenna, see Emergency access.

​
Profile and access problems

SSO sets a user’s name and photo only when it creates their account, from the claims your IdP sends.
  • If you skipped claims mapping, check that the integration that syncs your users is connected and has finished syncing.
  • If no integration syncs your users, check that the claims from the wizard’s Claims Mapping step are configured in your IdP. Users whose accounts already existed keep their old details until an integration updates them.
Ravenna doesn’t read groups, managers, or departments from SSO sign-ins. Connect a directory or HRIS integration that syncs them, such as Okta, Microsoft Entra ID, or BambooHR.
SSO sign-in adds users to your organization, but not to any workspace. Users who aren’t in a workspace land on the Portal home. Add them to a workspace. If a workspace grants access through user groups, new users appear in it after your IdP’s next sync, not at their first sign-in.
Removing a user from your IdP stops new sign-ins, but doesn’t block or remove their Ravenna account. Block the user in Ravenna.

​
Emergency access

Once SSO-only sign-in is enforced, which usually happens as soon as you enable the connection, no one in your organization can sign in another way, whatever their email domain. A backup admin account on a different email domain doesn’t get around this.
If your IdP is unavailable or no admin can sign in:
1

Check your IdP

Confirm whether the outage is in your IdP or in the SSO configuration.
2

Contact Ravenna support

If no admin can sign in, email Ravenna support to regain access.
3

Disconnect SSO if needed

Once an admin is signed in, you can disconnect SSO so users can sign in with Ravenna’s default sign-in methods until it’s fixed.
4

Tell affected users

Let users know how to sign in until SSO is back.

​
Get help

If these fixes don’t solve the problem, email Ravenna support with:
  • What happened, and what you expected to happen
  • The exact error message, or a screenshot
  • The email addresses of affected users
  • When the problem started, and any recent changes in your IdP
  • What you’ve already tried

Contact Ravenna support

Get help from the Ravenna team with SSO problems this page doesn’t cover.
Last modified on October 2, 2026