Troubleshooting
Fix common OIDC SSO connection and sign-in problems.
Work through these when a connection won't test, enable, or let members in.
| Who | Organization owner or admin |
| Applies to | Proliferate Cloud (self-hosted notes linked below) |
| Affects | The organization's SSO connection |
Common failures
| Symptom | Likely cause | Fix |
|---|---|---|
| Redirect URI is invalid | The URI registered with your provider doesn't match the one Proliferate uses. | Copy the exact value from the read-only Redirect URI field in the SSO form and register it verbatim; providers match it character-for-character. |
| Discovery failed / no such host | The Issuer URL is wrong or unreachable. | Open <issuer>/.well-known/openid-configuration in a browser — it should return JSON. |
| Token exchange failed | The Token auth method doesn't match your provider. | Switch between client_secret_basic and client_secret_post (or none). |
| Email domain is not allowed | The user's email domain isn't in Allowed domains, or the provider didn't return a verified email. | Add the domain, or have the user sign in with a matching, verified account. |
| SSO user is not a team member | The person authenticated but was never invited. | Invite them first, then have them sign in. |
Copy the redirect URI from the UI. Don't hardcode it from an example — the value shown in the SSO form is derived from your deployment's base URL and is the only one your provider should trust.
Why invite-first on Cloud
A connection carries a provisioning policy that decides what happens on first sign-in. The settings screen creates connections with provisioning disabled, so unknown users are rejected and the flow is invite-first.
The backend supports other policies (existing_user, create_member), but
the Cloud settings screen doesn't expose them today. Automatic account
creation on first sign-in (JIT provisioning) is configured only on self-hosted
deployments — see below.
Self-hosted deployments
Self-hosted SSO is configured with environment variables rather than the admin
UI. Provisioning is set with SSO_JIT_POLICY
(disabled | existing_user | create_member) and SSO_DEFAULT_ROLE;
SSO_LOGIN_POLICY accepts optional today (required is not supported yet),
and SSO_OIDC_CALLBACK_BASE_URL overrides the callback base URL. See
Self-hosted SSO for the
full reference.