> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ravenna.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Troubleshooting

> Fix common Ravenna SSO problems, including failed connection tests, access denied errors, missed SSO redirects, expired SAML certificates, missing profile details, and lockouts.

Find the problem you're seeing, then work through its fixes in order. Your identity provider's (IdP's) sign-in logs, such as the System Log in Okta or the sign-in logs in Microsoft Entra ID, usually show why a sign-in failed.

## Setup problems

<AccordionGroup>
  <Accordion title="The connection test fails" icon="circle-x">
    The wizard lists the errors when a test fails.

    * Make sure you're assigned to the Ravenna application in your IdP. The test signs you in as yourself.
    * Compare the connection details in the wizard with your IdP, such as the client ID and secret, metadata URL, or signing certificate. Copy them again if they don't match.
    * Keep the wizard tab open while the test runs.
  </Accordion>

  <Accordion title="The wizard marks claims as required, but an integration syncs your users" icon="list-checks">
    If a connected integration syncs user profiles, click **Next** on the **Claims Mapping** step without adding claims. See [Configure your identity provider](/integrations/sso/setup#configure-your-identity-provider).
  </Accordion>
</AccordionGroup>

## Sign-in problems

<AccordionGroup>
  <Accordion title="A user sees an access denied error" icon="shield-x">
    The user isn't assigned to the Ravenna application in your IdP. Ravenna shows the error message from your IdP, or "Access denied. Please contact support."

    * Assign the user, or a group they belong to, to the Ravenna application in your IdP.
    * Check that the user's account in your IdP is active.
  </Accordion>

  <Accordion title="A user isn't sent to SSO after entering their email" icon="mail-warning">
    Ravenna sends users to your IdP when their email domain belongs to your organization. If the user belongs to more than one Ravenna organization, Ravenna may use the last organization they signed in to instead.

    * Check that the user entered their work email, not a personal one.
    * Have the user sign in with your organization's [direct SSO login URL](/integrations/sso/setup#direct-sso-login-url), which skips the email step.
  </Accordion>

  <Accordion title="Google sign-in shows Access forbidden" icon="ban">
    Your organization enforces SSO-only sign-in, so Google sign-in is off. Users see **Authentication Error** with the message "Access forbidden".

    Have users enter their work email on the login page and click **Continue**, or use the [direct SSO login URL](/integrations/sso/setup#direct-sso-login-url).
  </Accordion>

  <Accordion title="Sign-in stops working for everyone" icon="triangle-alert">
    Something changed in your IdP, or your IdP is unavailable.

    * Check your IdP's status page and sign-in logs.
    * If your provider uses SAML, check whether its signing certificate has expired, and [replace the certificate](/integrations/sso/monitoring-maintenance#replace-an-expiring-saml-certificate).
    * If someone changed the Ravenna application in your IdP, such as its client secret or URLs, [edit the connection](/integrations/sso/monitoring-maintenance#edit-the-connection) to match.
    * If no admin can sign in to Ravenna, see [Emergency access](#emergency-access).
  </Accordion>
</AccordionGroup>

## Profile and access problems

<AccordionGroup>
  <Accordion title="Names or photos are missing or out of date" icon="user-round-x">
    SSO sets a user's name and photo only when it creates their account, from the claims your IdP sends.

    * If you skipped claims mapping, check that the integration that syncs your users is connected and has finished syncing.
    * If no integration syncs your users, check that the claims from the wizard's **Claims Mapping** step are configured in your IdP. Users whose accounts already existed keep their old details until an integration updates them.
  </Accordion>

  <Accordion title="Groups, managers, or departments are missing" icon="network">
    Ravenna doesn't read groups, managers, or departments from SSO sign-ins. Connect a directory or HRIS integration that syncs them, such as [Okta](/integrations/okta/overview), [Microsoft Entra ID](/integrations/microsoft-entra/overview), or [BambooHR](/integrations/bamboohr/overview).
  </Accordion>

  <Accordion title="New users can't see any workspaces" icon="layout-grid">
    SSO sign-in adds users to your organization, but not to any workspace. Users who aren't in a workspace land on the Portal home. [Add them to a workspace](/integrations/sso/user-management#add-a-user-to-a-workspace). If a workspace grants access through [user groups](/documentation/platform/workspaces/settings#user-group-membership), new users appear in it after your IdP's next sync, not at their first sign-in.
  </Accordion>

  <Accordion title="Someone who left still has a Ravenna account" icon="user-minus">
    Removing a user from your IdP stops new sign-ins, but doesn't block or remove their Ravenna account. [Block the user](/integrations/sso/user-management#deactivate-sso-users) in Ravenna.
  </Accordion>
</AccordionGroup>

## Emergency access

<Warning>
  Once SSO-only sign-in is enforced, which usually happens as soon as you enable the connection, no one in your organization can sign in another way, whatever their email domain. A backup admin account on a different email domain doesn't get around this.
</Warning>

If your IdP is unavailable or no admin can sign in:

<Steps>
  <Step title="Check your IdP">
    Confirm whether the outage is in your IdP or in the SSO configuration.
  </Step>

  <Step title="Contact Ravenna support">
    If no admin can sign in, email [Ravenna support](mailto:support@ravenna.ai) to regain access.
  </Step>

  <Step title="Disconnect SSO if needed">
    Once an admin is signed in, you can [disconnect SSO](/integrations/sso/monitoring-maintenance#disconnect-or-delete-the-connection) so users can sign in with Ravenna's default sign-in methods until it's fixed.
  </Step>

  <Step title="Tell affected users">
    Let users know how to sign in until SSO is back.
  </Step>
</Steps>

## Get help

If these fixes don't solve the problem, email Ravenna support with:

* What happened, and what you expected to happen
* The exact error message, or a screenshot
* The email addresses of affected users
* When the problem started, and any recent changes in your IdP
* What you've already tried

<Card title="Contact Ravenna support" icon="life-buoy" href="mailto:support@ravenna.ai" cta="Email support" arrow="true">
  Get help from the Ravenna team with SSO problems this page doesn't cover.
</Card>


## Related topics

- [Tips & troubleshooting](/guides/how-to/foundry/tips-and-troubleshooting.md)
- [Forward from Google Workspace](/integrations/email/forward-from-google.md)
- [Forward from Microsoft 365](/integrations/email/forward-from-microsoft.md)
- [Setup](/integrations/fleet/setup.md)
- [Freshteam](/integrations/freshteam/overview.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.