> For the complete documentation index, see [llms.txt](https://docs.madrix.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.madrix.dev/troubleshooting/sso-and-login.md).

# SSO and login

### When to use

* Looping login.
* SSO returns error after authenticating at the IdP.
* User authenticates but does not have access to the project.

### Quick checklist (2 min)

1. Test in an incognito/private window.
2. Clear cookies for the domain.
3. Confirm the user is in the correct tenant/organization.

### Diagnosis

#### 1) Permissions vs authentication

* **Authenticated** but does not see resources: usually permission/group related.
* **Not authenticated**: usually SSO/callback configuration.

#### 2) Callback and redirect URI

* Confirm if the `redirect/callback URL` from the IdP matches exactly what is configured.
* Check for differences in http/https or domain.

#### 3) Clock skew and expiration

* Do tokens expire quickly?
* Do errors vary by user/machine?

### How to resolve (patterns)

* **Loop**: clear cookies and review domain/callback.
* **403 after login**: adjust groups/roles and claim mapping.
* **Error only in one browser**: extension blocking cookies/3rd-party.

### When to escalate

* All users in an org fail.
* Reproducible callback error.
* Recent change in IdP (certificate/metadata) causing widespread breakage.

Before escalating, gather this evidence. It greatly reduces back-and-forth.

* Project and environment (Dev/Staging/Prod).
* Time of the error (with timezone).
* Steps to reproduce (short and deterministic).
* Full error message (no cropped screenshots).
* Screenshot of the screen (if applicable).
* Browser console (relevant errors and warnings).
* Tab **Network** (request that failed + status + payload, if there is no sensitive data).

{% hint style="info" %}
If there is a `requestId`, `traceId` or execution link, include it as well.
{% endhint %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.madrix.dev/troubleshooting/sso-and-login.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.