> ## Documentation Index
> Fetch the complete documentation index at: https://docs.k16solutions.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Troubleshoot SSO

> Diagnose SAML and OIDC configuration, mapping, and access failures.

Keep an existing authorized K16 session open while you test SSO. Use a separate browser profile or private window for the pilot user.

## Start with the visible symptom

| Symptom                                         | Check                                                                                                                          |
| ----------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------ |
| **Single sign-on** is missing from **Settings** | Confirm that your role can view SSO configuration.                                                                             |
| **New identity provider** is unavailable        | Confirm that your role can manage SSO identity providers.                                                                      |
| **Create** or **Save changes** is disabled      | Correct highlighted required fields and confirm that the SSO context has loaded.                                               |
| Provider does not appear for sign-in            | Confirm **Enabled for sign-in**, user assignment in the identity provider, and allow several minutes for changes to propagate. |
| User returns without access                     | Confirm that the asserted email or email claim matches the user's K16 identity.                                                |
| Sign-out does not reach the SAML provider       | Confirm that SLO is enabled on both sides and the provider metadata includes its logout service.                               |

## SAML checks

1. Confirm that uploaded content is valid SAML metadata, or that **Metadata URL** is HTTPS and reachable.
2. Confirm **SP entity ID** and **SAML ACS URL** in the identity provider.
3. Confirm **Email attribute mapping** matches the exact assertion attribute.
4. Review signing and encryption expectations with the identity-provider administrator.
5. Disable SLO until basic sign-in works.

## OIDC checks

1. Confirm that **Issuer URL** matches the issuer in discovery metadata and tokens.
2. Confirm that the exact **OIDC redirect URL** is allowed in the application.
3. Confirm **Client ID** belongs to that application.
4. Rotate **Client secret** if its state is uncertain.
5. Confirm **Email claim** and **Username claim** are present in the ID token.
6. If discovery is off, validate every manual endpoint URL.

## Protect access during recovery

<Warning>
  Do not use undocumented authentication paths or share protected values to recover access. Ask
  another authorized administrator or K16 Support to correct the provider through the supported
  administration flow.
</Warning>

* Do not delete the last working provider during a migration.
* Do not close the administrator session that can still reach **Settings** > **Single sign-on**.
* Record the provider name, protocol, time, and displayed error.
* Share metadata and logs only through approved channels after removing protected values.

## Replace or delete a provider

Create and validate the replacement first. Then disable the old provider and test again. Delete it only after affected users can sign in and sign out through the replacement.

Deletion can take several minutes to affect sign-in. If you deleted a provider by mistake, contact K16 Support.

Return to [SSO overview](/administration/sso/overview).