Single Sign-On & User Provisioning

Prev Next

Why do some users see a blank screen when logging in?

Logging in using Single Sign-on (SSO) can sometimes result in a blank screen after authentication. This could be for a couple of reasons.

A mismatch between the Azure username and the username stored on AWS Cognito. Azure is not case sensitive when authenticating users so entering usernames with upper or lower case should not make any difference. However, Cognito is case sensitive and so using the same username but in different cases will be seen as a different account and result in a mismatch in authentication information.

Where possible, avoid making changes to existing usernames in Azure. If this is required at any point, the Thrive Support Team will be able to help to get the correct user info updated.

If a user originally logged in manually and now needs to login using SSO, the Thrive team will need to make a change in order for this to be possible. Logging in using SSO on a previously manual account can also cause a blank page to display.

Why am I seeing the error ‘user has already been provisioned’ when I am trying to provision them?

This error can be caused when a user has not been fully provisioned with a ref value, but the username already exists on the platform. 

There are two ways this can happen: 

 

    • The user has been manually created before the user was provisioned in Azure but no ref value was assigned

    • The user has been authenticated, and thier account created, before the account has been provisioned with their data from Azure.

 

To resolve this error you will need to add the correct UPN as the ref value for the user record. Once the reference has been added, the record should update during the next resync and populate the details.

Can we authenticate SSO users against more than one domain?

Thrive can support provisioning from multiple sources, however, you can only authenticate users against one single Active Directory. Some of our clients use tools such as Azure B2B in order to authenticate users from other domains.