--- title: "SSO login issues" slug: "sso-login-issues" description: "Troubleshoot SSO login issues for Document360 with common errors and solutions, ensuring user access and correct configurations for seamless access." tags: ["SSO Troubleshooting", "SAML Configuration", "Identity Provider"] updated: 2026-11-13T11:33:41Z published: 2026-11-13T11:33:41Z canonical: "docs.document360.com/sso-login-issues" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.document360.com/llms.txt > Use this file to discover all available pages before exploring further. # SSO login issues If you encounter issues while logging in to the Knowledge base portal using SSO, refer to the following common errors and their solutions: ## User access not assigned in IdP **Error:** Sorry, but we're having trouble signing you in. Your administrator has configured the application Document360 to block users unless they are specifically granted (assigned) access to the application. ![Error message indicating trouble signing into Document360 due to access restrictions.](https://cdn.document360.io/860f9f88-412e-4570-8222-d5bf2f4b7dd1/Images/Documentation/4_Screenshot-Troubleshooting_user_access_not_assigned_idp.png) You may also see this error phrased as: **Error:** You do not have assigned access. NOTE This error indicates that the user or group attempting to log in is not assigned to the Document360 application in your organization's Identity Provider (IdP). Common IdPs include Microsoft Entra ID/Azure AD, Okta, and Google Workspace, but the steps below are generally applicable to any IdP. **Steps to resolve** To resolve this issue, 1. Log in to your organization's Identity Provider (IdP) admin portal. 2. Navigate to the Applications section and locate the Document360 application. 3. Open the Document360 application settings. 4. Assign the required users or groups to the Document360 application. 5. Save the changes. Once the users or groups are assigned, they should be able to access Document360 without encountering the error. **Example (Microsoft Entra ID):** If your IdP is Microsoft Entra ID, this error may also appear with the code **AADSTS50105**, for example: AADSTS50105: Your administrator has configured the application Document360 Limited to block users unless they are specifically granted ('assigned') access to the application. The signed in user '[user email]' is blocked because they are not a direct member of a group with access, nor had access directly assigned by an administrator. **To assign the user in Entra ID:** 1. In the Microsoft Entra admin center, select **Enterprise apps**, then open your Document360 application. 2. Select the **Users and groups** tab, then select **Add user/group**. 3. On the **Add assignments** page, select **Users and groups**, search for the user or group, select **Select**, then select **Assign**. For the full walkthrough, read [Entra with SAML SSO](/help/docs/saml-sso-with-entra). Once access is assigned, ask the user to sign in again using a private or incognito browser window. NOTE 1. The assignment of users or groups to the Document360 application is managed entirely within your organization's IdP. This process cannot be performed within Document360 itself. 2. Ensure that the users or groups assigned have the appropriate permissions as per your organization's access policies. --- ## User loses access after SSO configuration change When an organization replaces or disables an existing SSO configuration and sets up a new one, users who were enrolled in the old configuration may lose access to their projects. The user can sign in with their IdP credentials but cannot see any projects on their dashboard, and the admin menu is not visible in the portal. This happens because the user’s account is still linked to the old, now-inactive SSO configuration. Document360 cannot match the user to an active SSO configuration, so the project does not appear for them. ### Steps to resolve Before you start, ensure someone in your organization has access to the IdP used in the new SSO configuration. 1. Have the person who manages your IdP add the affected user to the new Document360 application in the IdP. This step must be completed before the user can sign in through the new SSO. 2. Log in to the Knowledge base portal as an Owner or Admin using an account that is already enrolled in the new SSO configuration. 3. Navigate to Settings > Users & Permissions > Users & groups. 4. Locate the affected user in the Users list. - **If the user appears in the list with an SSO badge:** Their account is still linked to the old SSO configuration. You must delete this account before re-adding the user under the new SSO configuration. To delete, select the checkbox next to the user, click Deactivate, select Delete user, and confirm. - **If the user does not appear in the list:** Proceed directly to step 5. 5. Click Add > User. 6. Enter the user’s email address, select the SSO user checkbox, and in the Select SSO dropdown, select the new SSO configuration. 7. Assign the appropriate project role and content access. 8. Click New user. 9. Ask the user to sign in using the new SSO configuration. **Note:** Document360 does not allow changing the SSO configuration of an existing SSO account directly. If the user’s account is still linked to the old configuration, it must be deleted and re-created under the new one. Roles and access permissions are not carried over automatically, so note the user’s existing settings before deleting their account. **Who can perform these steps:** A user with the Owner or Admin project role, or a custom role with the Manage users permission. --- ## No projects associated with email address **Error:** There are no projects associated with this email address. Please contact your Project administrator. This error indicates that the user’s account is not linked to any project in Document360. This can happen if the user has not been added or has been removed from Document360, but their account is linked to the Identity Provider (IdP). ![A user receives a message about no projects associated with their email address.](https://cdn.document360.io/860f9f88-412e-4570-8222-d5bf2f4b7dd1/Images/Documentation/5_Screenshot-Troubleshooting_no_project_associated.png) **Steps to resolve:** To resolve this issue, 1. Log in to the ****Knowledge base portal**** as an administrator. 2. Select the project to which the user needs access. 3. Navigate to **Settings** () in the left navigation bar in the Knowledge base portal. 4. In the left navigation pane, navigate to **Users & permissions** > **Users & groups**. 5. Check if you have added the user as an SSO account. - If the user's account exists but is not an SSO account, select the checkbox next to their account and click the **Convert to SSO account** option. - If the user is not listed as an SSO account, click **Add** > **Users** and select the **SSO user** checkbox while creating the account. --- ## Reader account not added as SSO user **Error:** You may not see a specific error message. Instead, you are returned to the login page, or you see a generic sign-in failure when trying to open the Knowledge base site. This typically happens when your email has not been added as a Reader in the Document360 project, even though your organization's Identity Provider (IdP) recognizes you. SSO confirms your identity with the IdP, but Document360 has no reader account to match it to, so access is denied. **Steps to resolve:** To resolve this issue, 1. Log in to the ****Knowledge base portal**** as an Owner or Admin. 2. Navigate to **Settings** () in the left navigation bar in the Knowledge base portal. 3. In the left navigation pane, navigate to **Readers & groups** > **Readers**. 4. Check whether the user's email is listed as a Reader. - If the user is not listed, add them as a new Reader and select the **SSO user** checkbox, then choose the appropriate SSO configuration. - If the user already exists as a non-SSO Reader, select the checkbox next to their account and use the **Convert to SSO account** option. 5. Assign the appropriate content access level, then click **Create reader account** (or **Save**, if converting an existing reader). Once the reader account has been added or converted, ask the user to try signing in again. NOTE This is different from the error "Sorry, you're not authorized to access this documentation," which appears when a reader account already exists but does not have access to the requested content. See [Log in using SSO - Knowledge base site](/docs/login-using-sso-knowledge-base-site) for that scenario. If the reader account does not exist at all, no specific in-product error message may appear — the user is simply unable to complete sign-in. --- ## Email address missing in SAML/ODIC response **Error:** Email address is missing in SAML/ODIC response, please check your SSO configuration or contact support. This error typically occurs when the **email** or **name** attributes in the SAML/ODIC response are not configured correctly in the Identity Provider (IdP). These attributes are case-sensitive, so it is important to ensure they match exactly as specified in the configuration. ![User receives an error message about missing email address for SSO login.](https://cdn.document360.io/860f9f88-412e-4570-8222-d5bf2f4b7dd1/Images/Documentation/6_Screenshot-Troubleshooting_email_address_missing_in_saml_odic.png) **Steps to resolve**: To resolve this issue, **Check attribute mapping in the Identity Provider (IdP)** 1. Log in to your Identity Provider (IdP) as an administrator. 2. Verify that the attributes for **email** and **name** are mapped correctly. 3. Confirm that the attribute names match exactly as specified in the Document360 documentation. For example, - Correct: “**email**” and “**name**”. - Incorrect: “**Email**”, “**EMAIL**”, “**Name**”, or “**NAME**”. **Update SSO configuration in Document360** 1. Log in to the ****Knowledge base portal**** as an administrator. 2. Select the project where the SSO is configured. 3. Navigate to **Settings** () in the left navigation bar in the Knowledge base portal. 4. In the left navigation pane, navigate to **Users & permissions** > **SSO Configuration**. 5. Select **Edit** () for the existing configuration. 6. Navigate to the **IdP configurations** section and ensure the mapped attributes in Document360 correspond to those configured in the IdP. 7. Save the updated configuration. Now, test the SSO login to confirm that the issue is resolved. --- ## Single sign-on is not enabled for this email **Error**: An error occurred while handling the request and ‘Single sign-on isn’t enabled for this email’ This error indicates that the user's email is not correctly configured in the Identity Provider (IdP) or in Document360. **Steps to resolve:** To resolve this issue, 1. Log in to the identity provider’s portal. 2. In the identity provider’s portal, navigate to **Applications,** and select the Document360 application. 3. Check if the users/readers are added to the Document360 application. 4. If the user/reader is missing, add them and assign the necessary permissions. Next, check if the SSO configuration has been completed correctly in Document360. To verify if the SSO configuration is correct, check the details from the [**SAML**](/help/docs/saml) and [**OpenID**](/help/docs/openid) articles. If the issue persists, please contact the [Document360 support team](mailto:support@document360.com) with the screenshots of the IdP configuration and Document360 SSO configuration. --- ## Unable to login via SSO **Error**: Single Sign-on is not enabled for this subdomain This error occurs when the incorrect subdomain or knowledge base portal link is used during login. It commonly happens if the project is hosted on one domain (e.g., **US**) but is being accessed through a different domain (e.g., **EU**). ![Login screen for Document360 with SSO option and subdomain input field.](https://cdn.document360.io/860f9f88-412e-4570-8222-d5bf2f4b7dd1/Images/Documentation/8_Screenshot-Troubleshooting_sso_not_enabled.png) **Steps to resolve**: **Verify Your Subdomain and Portal URL** - Ensure you are using the **correct subdomain** and accessing the right Document360 portal. - If your project is hosted in the **US domain**, use: [**https://portal.us.document360.io/**](https://portal.us.document360.io/) - If your project is hosted in the **EU domain**, use: [**https://portal.document360.io/**](https://portal.document360.io/) **Check Your Subdomain** - Navigate to **Settings** () in the left navigation bar in the Knowledge base portal. - In the left navigation pane, navigate to ****Knowledge base site**** > ****Custom domain**.** - In the Custom domain page, you can view your project link. If your project link is `https://test1.document360.io`, then your subdomain is **"test1"**. - You can also find your subdomain on the **Configure the Service Provider (SP)** page under your **SSO Configuration**. --- ## SSO login failure **Error**: This page isn’t working - identity.us.document360.io is currently unable to handle this request. HTTP ERROR 500. This issue occurs due to a change in the identity certificate. The signing certificate for authentication is rotated every three months, and if the updated certificate is not configured correctly in the Identity Provider (IDP), authentication may fail. ![Error message indicating the page is not working due to HTTP error 500.](https://cdn.document360.io/860f9f88-412e-4570-8222-d5bf2f4b7dd1/Images/Documentation/7_Screenshot-Troubleshooting_sso_http_error_500.png) **Steps to resolve**: Follow these steps to resolve the issue: 1. Ensure that you configure the **metadata URL** correctly in the **Identity Provider (IdP)**. This URL is available on the **SSO page** in Document360 and reflects the latest signing certificate information. 2. If the issue persists, contact [**support@document360.com**](mailto:support@document360.com) for assistance. --- ## 404 error during SSO configuration **Error**: This identity.us.document360.io page can’t be found. No webpage was found for the web address. HTTP Error 404. This issue might occur if the federation URL for the Identity Provider (IdP) was incorrectly configured or if the email address used had no associated projects in the system. ![404 error](https://cdn.document360.io/860f9f88-412e-4570-8222-d5bf2f4b7dd1/Images/Documentation/Troubleshooting_SSO.png) **Steps to resolve:** 1. Verify the federation URL of your SSO connection. The 404 error usually indicates that the URL is incorrect or inaccessible. To verify, 2. Navigate to your Identity Provider’s SSO configuration section. 3. Look for the federation metadata URL, login URL, or SAML endpoint URL. This URL must match exactly with what's configured in your Document360 SSO settings. 4. Double-check your credentials and ensure you have entered the correct federation URL in your IdP. 5. Once the federation URL is copied from your IdP, and related configurations are corrected, confirm that your email address is linked to at least one project. 6. If there are no projects associated with your email, you may need to be added as a [new SSO user account](/help/docs/inviting-or-adding-sso-users). 7. Follow best practices when converting other users to SSO accounts. - Always copy the federation URL directly from your IdP—avoid manual typing. - Ensure that each user’s email is added to at least one active project in Document360 before enabling SSO. - Confirm that the email domains of the users match your SSO setup. - Add new users as SSO users in your project before they attempt to log in. - Maintain a list of verified SSO users with proper role mappings in the system. 8. If the issue persists, contact [**support@document360.com**](mailto:support@document360.com) for assistance. --- ## 500 error during SSO login to knowledge base portal **Error**: 500 login error Possible causes are an outdated or expired SAML certificate, or if the site is set to public (SSO is intended for secure, private portals). **Steps to resolve:** 1. Confirm that your Knowledge base portal is [not set to public](https://docs.document360.com/help/docs/en/workspaces-1#adding-a-new-workspace). SSO authentication requires the site to be private. 2. Check the status of your SAML certificate. If it's outdated or expired, update it on your identity provider's end. 3. Retry logging in using SSO after updating the certificate. --- ## SSO login issue: HTTP 500 error **Error:** *This page isn’t working -* [*identity.document360.io*](http://identity.document360.io) *is currently unable to handle this request - HTTP 500 ERROR* **Steps to resolve:** 1. Check if the issue is affecting all users associated with the project’s SSO Identity Provider. 2. If the issue is isolated to a specific user, it may be related to browser or network settings. 3. Try logging in using an incognito/private browsing panel. 4. Switch to a different internet connection and attempt the login. 5. Use a different device to log in and see if the issue persists. If the issue persists after following these steps, please contact the Document360 support team for further assistance: [Contact Document360 Support](https://document360.com/support/) If you use OpenID Connect SSO and the HTTP 500 error appears before your identity provider's login page opens, check the client authentication method in your identity provider. See [OpenID SSO issues](/help/docs/openid-sso-issues). Provide the following details: - SSO configuration details for the project and the associated Identity Provider. - A generated product log file. For instructions, read the article on [Generating a HAR File](/help/docs/document360-support-generating-a-har-file). - A screen recording that demonstrates the issue in detail. --- ## Failed to parse token response body as JSON **Error:** An error was encountered while handling the remote login. Failed to parse token response body as JSON. Status Code: 200. Content-Type: text/html; charset=UTF-8. This error occurs with OpenID Connect SSO when your identity provider (IdP) returns an HTML page instead of a token. The most common cause is the client authentication method. Document360 sends the client ID and secret in the body of the token request (`client_secret_post`). It doesn't support `client_secret_basic`, which sends them in an HTTP Authorization header. **Steps to resolve:** 1. In your IdP, open the application you created for Document360. 2. Set the token endpoint authentication method to **Client Secret Post** or `client_secret_post`. 3. Save the application. 4. Sign in again using SSO from a private browser window. For other causes of this error, and for related OpenID Connect errors, see [OpenID SSO issues](/help/docs/openid-sso-issues). --- ## FAQ **What are the prerequisites for inheriting an SSO configuration from an existing project?** To inherit an SSO configuration from an existing project, ensure that: - The user performing the configuration has **Admin** or **Owner** access to both the parent and child projects. - The same user account is associated with all projects involved in the inheritance process. **Note:** In Document360, SSO and non-SSO user accounts are treated as separate accounts even if they use the same email address. To successfully inherit SSO settings across projects, ensure that the user is added as a **non-SSO user** in all relevant projects. **Can the same email address exist as both an SSO Team Account and a Reader account?** Yes. Document360 treats SSO Team Accounts and regular Reader accounts as separate account types, even when they share the same email address. This is because they use different authentication methods: - The SSO Team Account authenticates through your identity provider (such as Okta or Azure). When this account signs in via SSO, the user is directed to the knowledge base portal. - The Reader account authenticates with a Document360 password. When this account signs in with a password, the user is directed to the knowledge base site. - A conflict only arises if you attempt to add the same email address twice under the same account type (for example, two SSO Team Accounts or two password-based Reader accounts). - If you want to consolidate these into a single account, remove the Reader account and retain only the SSO Team Account, or convert the Reader to an SSO Reader. A secure endpoint URL provided by your Identity Provider (IdP) — such as Okta, Entra ID, or ADFS — that Document360 uses to validate SSO authentication requests. Enter it under Settings > Users & permissions > SSO Configuration when configuring SAML. Always copy the Federation URL directly from your IdP to avoid 404 errors during SSO login. ## Related - [ADFS with SAML SSO](/saml-sso-with-adfs.md) - [ADFS with OpenID SSO](/adfs-with-openid-sso.md) - [Other configurations with SAML SSO](/saml-sso-with-other-configurations.md)