If SSO reports an error, find the matching error code below to understand the cause and apply the recommended solution.

Problem: A user has successfully authenticated with their identity provider, but iHasco won't authorise a session because SSO has been configured to only allow access for registered users. Other SSO users are accessing iHasco without a problem.

Fix: Add the user manually (or via bulk upload), or modify the SSO configuration to allow access to unregistered users (this is the default).

Still a problem, or affects all users? Check that the SSO configuration is correct (IDP configuration may have changed), and that the security registration method is set to Single Sign On provider in the LMS.

Problem: The required user attributes (email address, first name, and last name) have been incorrectly mapped, or the IDP is now sending different attribute names.

Fix: Check that the SSO user attribute configuration is correct (IDP attribute names may have changed).

Problem: An authentication URL was manually (mis)typed by a user.

Fix: There should be no need for users to enter any authentication URLs — SSO users only need to visit their iHasco training URL.

Problem: The SAML security assertion has already been sent. This is a security measure to prevent replay attacks.

Fix: The user should close the browser and re-attempt login.

Problem: The identity provider is attempting to initiate an SSO flow.

Fix: iHasco only supports service-provider-initiated SSO. The identity provider must be configured with a start URL set to the iHasco training URL.

If you can't resolve the error using the guidance above, see I can't resolve SSO issues, what should I do?

For help setting up SSO, see How do I configure Single Sign-On (SSO) for Atlas?