Troubleshooting

The user is authenticated but access is denied

On the IdP side, the user is not assigned to the application, or their groups do not match the application's rules.

The user is authenticated but "access denied"

Probable cause. On the IdP side, the user is not assigned to the application, or their groups do not match the application's rules.

What to do? Assign the user (or their group) to the application in the IdP, then check the group attributes being sent.

To see exactly which check fails, paste the response into theanalyseur, or paste the message into the diagnostic.

Related errors

Want to see it for real? ID-Kit plays the role you are missing and shows you each step.