Skip to main content

Troubleshooting SSO Issues

Quickly identify and resolve common Single Sign-On (SSO) problems using simple checks and fixes.

SSO Requirements and Considerations

  • Only one Identity Provider (IdP) is supported per company

  • Users are identified by email only

  • SSO users are created after the first successful login

  • Older setups may have domain configuration differences

  • Email delivery issues can impact SSO workflows, such as not receiving password reset emails or user creation notifications.

Common SSO Issues and Fixes

Before You Start, answer these questions to narrow down the issue:

  • Is the issue affecting one user or multiple users?

  • Does the issue happen every time or only sometimes?

  • Does it work in an incognito or private browser window?

These answers help determine the root cause faster.

“We Can’t Find Your User” Error

Knak matches users by email. Your Identity Provider (IdP) must send the user’s email as the SAML NameID for SSO to work correctly.

Azure

Update your Azure SSO configuration:

  1. Open your Knak Enterprise Application in Azure

  2. Go to Single Sign-On (SAML)

  3. Find Unique User Identifier (Name ID)

  4. Set the value to:

    user.mail

  5. Save your changes

  6. Retry Continue with SSO

Okta

Okta sends email by default. Issues usually happen after customization. For example, if Okta sends only a name or a different email address instead of the full email, Knak will not recognize the user and redirect them back to the login page.

  1. Open your Knak app in Okta

  2. Go to Sign On settings

  3. Locate Name ID format / Application username

  4. Set it to use the user’s email

  5. Save and retry login

Ping (or Other SSO Providers)

Your IdP must send email as the SAML NameID.

  1. Open your IdP SAML configuration for Knak

  2. Locate NameID settings

  3. Set NameID to the user’s email address

  4. Save changes

  5. Retry login

"Continue with SSO" Button Fails but Direct Login Works

You can log in using your company’s SSO login URL, but the “Continue with SSO” button does not work.

Why this Happens:

These two login methods handle your identity differently:

  • “Continue with SSO” button
    → Requires your email to match exactly in Knak

  • Direct IdP login URL
    → May allow login using a different identifier

If your Identity Provider (IdP) sends something other than your email (such as a username or internal ID), the button flow will fail.

How to Fix

Update your IdP to send your email as the SAML NameID.

  1. Ensure the identifier matches your email in Knak

  2. Retry using “Continue with SSO” after updating

How to Confirm

  1. Try logging in using the direct IdP URL

  2. If that works, but the button fails, this is likely the issue

One User Cannot Log In

Potential Reasons:

  • Email address was recently changed

  • User was removed and re-added

  • IdP and Knak emails do not match

How to Fix

  • Confirm the email in your IdP matches your Knak account

  • Retry login after updating

SSO Works Sometimes but Not Always

You might be sent back to the Knak login page after you sign in. Or your login might fail sometimes and work when you try again.

Possible cause

This is usually caused by a problem with your browser session or cookies. Cookies are small files your browser saves to remember that you’re signed in.

How to fix it

Clear your Knak cookies:

  1. Open Knak in your browser.

  2. Click the icon on the left side of the address bar.

  3. Click Site settings.

  4. Clear the cookies for Knak.

  5. Close all Knak tabs.

  6. Open Knak again and sign in.

Other quick fixes:

  • Open Knak in a private or incognito window.

  • Open Knak in a different browser.

  • Sign out of your single sign-on (SSO) provider, such as Okta. Then sign in to Knak again.

Fix the “Client Authentication Failed” Error

You may see the following error when authenticating with Okta:

{"error":"invalid_client","error_description":"Client authentication failed","message":"Client authentication failed"}

This error means your Open Authorization (OAuth) client credentials are invalid or configured incorrectly.

The most common causes are:

  • An incorrect client_id

  • An incorrect or incomplete client_secret

  • An incorrect redirect URL

Check Your Okta Configuration

Complete these steps in your Okta Admin Console:

  1. Confirm your client ID. Go to your app's General tab. Make sure the client_id exactly matches the value shown in Okta.

  2. Regenerate your client secret. Create a new client_secret. Copy the full value when you create it. Okta does not display the secret again after creation.

  3. Check your supported provisioning actions. Go to the Provisioning tab. Confirm the following actions are enabled:

    • Import new users

    • Push new users

    • Profile updates

  4. Verify your redirect URL. Confirm the redirect URL exactly matches:
    ​https://system-admin.okta.com/admin/app/cpc/_/oauth/callback

  5. Check your System for Cross-domain Identity Management (SCIM) settings. Go to Applications > your app > Provisioning. Confirm the SCIM connector base URL and authentication settings are correct and saved.

Try the Connection Again

Save your changes. Try authenticating with Okta again.

If the error continues, regenerate the client_secret one more time. Carefully copy the complete value before saving it.

Redirected to Knak Login Instead of Your IdP

You click “Continue with SSO”, but instead of being redirected to your Identity Provider (IdP), you are taken back to the Knak login page.

Potential Reasons:

Knak cannot determine which IdP to send you to. This usually happens when:

  • Your SSO configuration is incomplete or misconfigured

  • Your company’s domain or connection is not recognized

  • There is a mismatch between expected login domains

How to Fix

Step 1: Try direct login

  • Use your company’s SSO login URL

  • If this works, your SSO setup is partially correct.

Step 2: Contact Knak Support

Share the following details:

  • Your company name

  • Your user email

  • What happens when you click “Continue with SSO”

  • Whether all users are affected

  • Whether the issue started after a recent SSO change

  • Whether direct login also fails

Sign-In Returns to the Login Page After You Sign In to Your IdP

You sign in at your Identity Provider (IdP). Then Knak sends you back to the login page. This can happen when Knak cannot read your signing certificate. Every user at your company is affected.

How to Fix

Upload your certificate again in the Base64 (PEM) format. Follow these steps:

  1. Download the signing certificate again from your IdP. Choose the Base64 or PEM option.

  2. Open the file in a plain text editor, such as Notepad.

  3. Check that the text starts with -----BEGIN CERTIFICATE----- and ends with -----END CERTIFICATE-----.

  4. Remove any extra text before or after those lines. Examples are "Bag Attributes" or a private key block.

  5. Save the file as UTF-8 in your text editor.

  6. Upload the file on the SSO page in Knak, then click UPDATE.

The file will not work if it is unreadable or garbled. It will also fail if it starts with -----BEGIN PKCS7-----. The file ending (.cer, .crt, or .pem) does not decide the format. Always check what is inside the file.

If You Use PingFederate

  • Check that the Assertion Consumer Service URL in your IdP matches the Single Sign on URL shown on the Knak SSO page.

  • Open your Knak connection in SP Connections. Go to Credentials, then Digital Signature Settings.

  • Keep the Knak certificate selected as the signing certificate.

  • Select the option to include the certificate in the signature KeyInfo element.

  • Save the connection and try SSO again.

If SSO still fails, contact Knak Support. Share your company name and the time you tried to sign in.

Logout Does Not Redirect to Your SSO login page

You log out of Knak, but you are not redirected to your Identity Provider (IdP) logout screen.

Potential Reason:

  • A logout redirect URL is not configured for your account

How to Fix

  • Contact Knak Support

  • Share your user access URL

  • Support will configure the logout redirect for your account

SSO Fails for Multiple Users

Several users from your company cannot log in at the same time.

Potential Reasons:

  • IdP outage or configuration issue

  • Possible system-wide issue

How to Fix

  • Check with your internal admin

  • Contact support with details

Common Email Issues

Email delivery problems can impact account access and SSO workflows.

Examples include:

  • Users do not receive password reset emails.

  • Specific recipients do not receive emails sent from Knak.

  • Users created using Create SSO User do not receive an invitation email.

Steps to Troubleshoot Email Delivery

Check Spam or Junk Folders

Ask the user to review their spam or junk folders.

Review Email Filtering

If only specific recipients are affected, their email system may be blocking messages.

Ask the organization's email administrator to:

  • Whitelist the Knak sending domain.

  • Whitelist the sender address used by Knak.

Verify the Email Address

Confirm the email address is correct in the Users section of Knak.

  1. Navigate to the Admin area of Knak.

  2. Click the Users tab.

  3. Locate the affected user.

  4. Click the Edit icon next to the user.

  5. Review the email address listed in the user details.

  6. Confirm the email address matches the intended recipient.

  7. Correct the email address if needed.

  8. If the user needs a new invitation email, return to the Users list and click the Envelope icon next to the user to resend the invitation.

Users page showing both the Edit icon and the Envelope icon used to resend an invitation email.

Forgot Password Email Not Received

If a user does not receive the password reset email:

  1. Have an administrator set a temporary password for the user.

  2. Ask the user to log in with the temporary password.

  3. Have the user update their password.

  4. Continue using password authentication or SSO.

Users Created with "Create SSO User" Do Not Receive A Knak Invite Email

Users created using Create SSO User do not receive the standard Knak invitation email.

Their account is finalized after their first successful login through the Identity Provider. This process automatically creates their profile in Knak.

Need more help? Contact support via live chat using the chat bubble in the bottom right corner or email support@knak.com.

Related Articles
Did this answer your question?