Skip to content
Vectis
Book a demo

Troubleshooting

Fix common single sign-on and SCIM problems.

"Invalid redirect URI" or AADSTS50011

Cause: the redirect URI configured in your identity provider doesn't match the one Vectis sends.

  • Make sure the redirect URI is exactly https://<your Vectis address>/sso/callback.
  • Check for trailing slashes. They must match exactly.
  • Check the protocol is https.

"No matching user found"

Cause: the user's email from your identity provider doesn't match any invited or provisioned user in Vectis.

  • Ask Vectis support to turn on JIT provisioning for your SSO configuration, so users are created on first sign-in.
  • Or invite the user to your organisation before they try to sign in with SSO.
  • Check that the email claim in the ID token matches the user's Vectis email.

"SSO is not configured for this organisation"

Cause: your organisation has no active SSO configuration.

  • Contact Vectis support to configure SSO, or to check that your configuration is enabled.
  • If it was set up recently, domain verification may still be pending.

Token validation fails

Cause: the ID token from your identity provider fails signature or claims validation.

  • Check the client ID you gave Vectis matches the aud claim in the token.
  • Check the issuer URL matches the iss claim in the token.
  • For Entra ID, check the tenant ID is correct.
  • Make sure your identity provider's JWKS endpoint is reachable from Vectis.
  • Vectis caches your provider's OIDC metadata. Wait 24 hours, or contact Vectis support to refresh it.

Groups or roles missing from the token

Cause: your identity provider isn't including group claims in the ID token.

  • Entra ID: go to Token configuration → Add groups claim.
  • Okta: configure a groups claim on the authorisation server.
  • Auth0: add a custom Login Action that includes roles.
  • Google: Google doesn't support group claims by default. Use SCIM provisioning instead.

SSO sign-in goes to a different organisation

Cause: the email domain is shared between several organisations, or domain verification is incomplete.

  • Make sure the DNS TXT record for domain verification is in place.
  • Ask Vectis support to confirm only one SSO configuration claims your email domain.

"SSO authentication was not completed" (mobile)

Cause: the system browser was closed before the user finished signing in.

  • Ask the user to complete the sign-in in the system browser before returning to the app.

SCIM provisioning fails

Cause: a token or payload problem.

  • Check the SCIM bearer token hasn't been revoked.
  • Check the SCIM base URL is the one Vectis gave you (ending in /scim/v2).
  • Test connectivity with GET /scim/v2/ServiceProviderConfig.
  • Check the SCIM payload matches the expected schema. See SCIM provisioning.

Diagnostic steps

  1. Check OIDC discovery: open {issuer_url}/.well-known/openid-configuration in a browser.
  2. Check the token: decode the ID token and confirm its claims.
  3. Ask Vectis support: Vectis can run an SSO health check for your organisation and review the SSO error log for recent failed sign-ins.

Getting help

If problems continue after following this guide, contact Vectis support with:

  • the exact error message the user saw,
  • your identity provider type, and
  • your configuration details, excluding secrets.