SSO sign-in is not working

Use these checks when a user cannot sign in through SAML single sign-on (SSO).

Check the metadata URL

• The URL in Organisation Settings must be a public HTTPS metadata URL, not a downloaded file path or administration-page URL.

• Open it outside the identity-provider session and confirm that it returns current SAML metadata.

• If the provider rotates a signing certificate, publish the new certificate through the metadata URL and test before the old certificate expires.

Check the Flinq application URLs

Confirm that the provider uses the exact Entity ID, Assertion Consumer Service URL and sign-on URL for your Flinq workspace. A placeholder, hash, braces, old workspace name or incorrect domain will cause sign-in to fail.

Check claims and user access

• The SAML response must include a unique email address. Supply the name claim when your identity provider supports it.

• The email must match the intended Flinq account.

• Assign the user to the Flinq application in the identity provider.

• Confirm that the user belongs to the correct Flinq office and has a suitable role.

Common symptoms

• Returned to login: check the callback URL, metadata availability and response signature.

• No office or inactive-account page: add the user to an office and assign a role with meaningful permissions.

• Wrong account: check the email claim and any cached identity-provider session.

• Failure after certificate rotation: confirm the new certificate is present in the live metadata and that system clocks are correct.

Recover safely

Use the recovery administrator to restore the last working metadata URL if a change fails. Preserve the error time, affected email address and identity-provider correlation details, then contact Flinq support without including assertions, private keys or secrets.