Troubleshooting
Fix common problems when setting up and using single sign-on.
| Problem | What to check |
|---|
| Verify says the TXT record was not found | Wait a few minutes and try again. Check the record with dig +short TXT acme.com. |
| The record exists but still is not found | The name may be wrong. Many DNS providers add the domain for you, so a name of acme.com creates acme.com.acme.com. Use @ or leave the name empty. |
| The domain is refused when you add it | Shared email providers (gmail.com, outlook.com and similar) cannot be used, and a domain verified by another organization cannot be added. |
| Message | What to check |
|---|
| The issuer URL must point to a public identity provider | The issuer must be reachable from the internet over https://. Internal or private addresses are refused. |
| Could not read the OpenID configuration from that issuer URL | The issuer is wrong or unreachable. Open <issuer>/.well-known/openid-configuration in a browser to check it. |
| That URL publishes a different issuer | Use the exact issuer value from the provider's OpenID configuration, for example with or without /oauth2/default. |
| Enter your Microsoft Entra tenant ID | Use the Directory (tenant) ID GUID, not a domain name or common. |
| Verify at least one domain before connecting Google Workspace | Verify a domain first. |
| Message | Cause and fix |
|---|
| The account you signed in with isn't on one of your verified domains | Sign in with a company account, or verify that account's domain. For Entra, the user's sign-in name must be on a verified domain. |
| Your identity provider didn't confirm that the email address is verified | The user's email is not marked verified in your identity provider. Verify it there and test again. |
| Your identity provider didn't send a usable email address | The user has no email address in your identity provider. Add one and test again. |
| Your identity provider refused the sign-in | Check the client ID, the client secret and the redirect URI registered in your identity provider. |
| The connection changed while the test was running | Someone saved the settings during the test. Run it again. |
| The test was started in another tab or browser / The test expired | Run the test again from the setup page and finish it within 10 minutes. |
| Error | Fix |
|---|
redirect_uri_mismatch (Google) or a redirect URI error (Okta, Entra) | The redirect URI in your identity provider must be exactly https://sso.armoriq.ai/callback, with https and no trailing slash. |
| Google: Access blocked or admin has restricted this app | Your Google Workspace admin restricts third-party apps. Ask them to allow the OAuth client, or create it in a project inside your Workspace organization with an Internal audience. |
| Okta: user is not assigned to the client application | Assign the user, or one of their groups, to the ArmorIQ app in Okta. |
| Entra: the user needs admin approval | Grant admin consent under API permissions in the app registration. |
| Problem | What to check |
|---|
| Continue with SSO says SSO isn't set up for the email | SSO is off, or the email's domain is not verified in your organization. |
| A new person lands in their own workspace | Expected. SSO does not add people to your organization; invite them. |
| Sign-in stopped working for everyone | The client secret may have expired (common with Entra). Paste a new one, save, test and turn SSO back on. |
