Troubleshooting SSO and provisioning

Troubleshooting your SSO connection can be tricky. Here's a list of items to check in SonarQube Cloud and with your identity provider.

SSO connection doesn’t work

There may be several reasons why your SSO connection doesn't work properly:

• The user entered an invalid key or you sent them an invalid login URL. See Complete SSO setup.

• The user is not a member of any organization in the enterprise. See Adding organization members.

• The group synchronization failed. See Complete SSO setup.

• The SSO configuration is incorrect.

  • Check the attribute mapping (specifically email).

  • If it still doesn’t work, check the other SSO settings and test your connection.

  • See also Checking setup warnings below.

• You use GitHub and SSO and have configured an IP allow list in GitHub. In that case, disable the configuration in GitHub and try again.

403 error on signing in via SSO

If you encounter a 403 error during SSO sign-in, it may be due to having multiple sign-on URLs configured in your identity provider. To resolve this, ensure that you configure only one sign-on URL. Use the value from the Single Sign-On URL field in the SonarQube Cloud's SSO setup assistant for this configuration. For more information, see Set up SSO.

SCIM provisioning doesn't work

You should first check for setup warnings as explained below.

SCIM provisioning will not work properly if Single-Sign On has not been properly set up in your system.

Checking setup warnings

1. Retrieve your enterprise. See Managing your enterprise for more details.

2. Select Administration > SSO & Provisioning. The SSO & Provisioning page opens.

3. Expand the Single sign-on & Domain configuration section, and select Edit configuration. The Configure Your Connection page opens. Setup warnings are indicated on this page as illustrated below.

1. If there is a warning, open the corresponding setup assistant and follow the instructions.

The SSO's attribute mapping was changed recently. If your SSO setup was performed before this change, a warning will be displayed on this page for Single Sign-On. In that case, select Single Sign-On and follow the instructions to update your mapping in SonarQube Cloud. Check also the attribute mapping in your identity provider to make sure it matches the new SonarQube Cloud's mapping. For more information, see Set up SSO.

Related pages

• Editing or deleting SSO configuration

• Deleting an SSO account