Your SSO connection is configured and it's time to try it. This article covers testing, the errors you're most likely to hit, and the one piece of maintenance that will otherwise break your logins without warning.
Test with one user first
- Check your test user is assigned to the application in your identity provider, and is a member of at least one mapped group.
- Open the CheckHub login page in a private or incognito window, so an existing session doesn't interfere with the test.
- Log in with the user's corporate email address. You should be sent to your identity provider, authenticate there, and land back in CheckHub.
- Open the user's profile in CheckHub and check the name, email and groups match your directory.
Once that works, assign the rest of your team and let them know they can use their corporate account.
If CheckHub shows an error message
Message | What it means | What to do |
Sign-in is not configured correctly. Please contact support. | The connection itself is rejected on our side | Contact us — this one is ours to fix |
Access was denied by the identity provider. | Your provider refused the user | Usually the user isn't assigned to the application, or a conditional access policy blocked them |
Sign-in was cancelled. | The user cancelled or went back at the provider's screen | Just try again |
Too many sign-in attempts. Please wait a few minutes and try again. | Rate limited after repeated attempts | Wait a few minutes |
The sign-in service is temporarily unavailable. Please try again later. | A temporary outage | Try again later |
We couldn't process your sign-in request. Please try again. | The request reached us malformed | If it repeats, contact us |
We couldn't sign you in. Please try again later. | Anything else | Contact us with the details below |
If you land back on the login page with no message at all
This one is worth knowing about, because nothing on screen explains it. Your provider authenticated the user successfully, but CheckHub didn't accept them. There are three possible reasons:
- No group matched — by far the most common. Check the claim is named
groups, that it's really being sent, and that each value appears in the External ID or Name of a group under Settings > Groups. See "Map user attributes and groups for SSO".
- The email address already belongs to a CheckHub account in another company. This affects one person while everyone else works fine. Contact us and we'll check.
- SSO isn't enabled on your account yet. Contact us.
If your provider shows the error, before you get back to CheckHub
What you see | Usually means | What to do |
AADSTS50105 | The user isn't assigned to the app in Entra ID | Add the user or their group under Users and groups |
"Invalid audience" or "Audience mismatch" | The Entity ID doesn't match | Re-copy the Entity ID we sent you, with no trailing space |
The redirect fails after login | The ACS URL is wrong, or the ?connection=... part was dropped | Re-copy the ACS URL in full |
Your provider rejects the Reply URL | It doesn't accept ? query strings | Ask us for an alternative URL format |
Other things that come up
The user logs in but has no name, or the wrong email. Attribute claims are missing, misspelled or namespaced. Claim names must be exactly email, firstName, lastName, phone, with no namespace.
It worked for months, then stopped for everyone at once. The signing certificate expired — see below.
When you write to us about a failed login, include the time, the email address used, the message shown (or that there wasn't one), and any error or correlation ID your provider displayed. That lets us find the exact request in our logs.
Renew your certificate before it expires
This is the one that catches people out. SAML signing certificates have a fixed lifetime — three years in Microsoft Entra ID by default, around five years in Google Workspace. When the certificate expires, every single SSO login stops working at the same moment.
Set a calendar reminder for one month before the expiry date. To renew:
- Generate a new signing certificate in your identity provider.
- Send it to us before you activate it.
- Agree a switch-over time with us, then activate the new certificate.
Removing someone's access
Disable or delete the user in your identity provider, or remove them from the assigned groups. They lose access to CheckHub immediately. This is the recommended way to offboard staff — there's no separate CheckHub password left behind.