Why can't a new SSO user sign in for the first time?

Why this happens

Most often, the cause is the Require an admin-bound SSO subject option. It comes with a tick by default. With it on, an admin must set the person's immutable subject before their first login, and the verified-email shortcut is off.

A second cause is a missing account. Cyberlop matches people to accounts by their verified identity, so without an account the sign-in has nothing to match. Automatic creation, if you use it, has its own conditions.

How to fix it

1. Check that the person has a Cyberlop account. If not, ask an admin to create one.
2. Ask an admin to set the person's SSO subject on their account. The app shows where.
3. Ask the person to sign in again through single sign-on.
4. If you rely on automatic creation, confirm the box has a tick, the email sits on an allowed domain and a user seat is free.

You can untick the admin-bound option instead, which lets Cyberlop match by verified email. The setting text recommends keeping it on, so treat that as a deliberate security decision, and make it with the people who run your identity provider.

Still not working?

Check the redirect URI in your provider matches the one on the page exactly. Confirm that you enabled single sign-on and saved it.

Related reading: what the admin-bound option does, why no account appeared and setting up single sign-on. Need a hand? Use the contact page.

Related questions

• What does "Require an admin-bound SSO subject" do?
• Why didn't a new SSO user get an account automatically?
• How do I set up single sign-on with my identity provider?
• How do I let new people get accounts automatically through SSO?
• Why can't I tick "Enable single sign-on"?

Full tutorial

Single sign-on: set up OIDC, the redirect URI and account binding

Step-by-step, with annotated screenshots.

Updated 8 October 2026 · Back to the help centre