Troubleshooting

Your first stops: the sync-status panel on the LocalCan SSO settings page (last SCIM event, last successful SSO sign-in, members awaiting seats), your team's audit log, and the Tasks console in your Okta admin, where per-user provisioning errors land with the exact reason.

SSO error after Okta sign-in

The user authenticates at Okta but lands back on the LocalCan login page with an error banner. Two common causes:

• The app's Single sign-on URL or Audience URI still hold the setup placeholders, or no longer match your SSO settings page. Re-paste the ACS URL and Audience URI from LocalCan into the Okta app.
• The app's SAML signing certificate was rotated in Okta, so LocalCan holds a stale certificate. Contact support@localcan.com↗ to update it. Okta app certs are ~10-year lived, so this is rare.

SSO error after clicking the Okta tile

SAML app tiles perform IdP-initiated sign-in, which LocalCan rejects by design. Hide the app icon and give users an Okta Bookmark App pointing at the LocalCan login page instead.

"User is not assigned to this application"

Okta blocks the sign-in before LocalCan is involved: the user (or their group) isn't assigned to the app. Assign the group to the app and confirm the user is in it.

Some users error during a bulk assignment

Their email domain isn't among the connection's verified domains (common when assigning everyone in the org), or the app's Application username isn't Email. Assign only users on verified domains, add the missing domain in LocalCan, or fix the username format. The Okta task shows the exact reason per user.

Exactly one user errors when offboarding

That user is the LocalCan team owner. IdP deprovisioning of the owner is refused; everyone else proceeds. Transfer ownership in LocalCan first, or remove the owner in LocalCan directly.

"Test Connector Configuration" fails

Usually a typo in the SCIM connector base URL. Re-paste the SCIM base URL exactly from the LocalCan SSO settings page.

Every SCIM request fails with 401

The bearer token is wrong or was rotated, or a leftover app from an earlier setup keeps pushing with a revoked token. Rotate the token in LocalCan, paste the new one into Okta, and deactivate leftover apps. The token panel's last-used time confirms Okta switched.

The Provisioning tab is missing or can't be set to SCIM

Your Okta org lacks the Lifecycle Management SKU. Contact your Okta account rep. SSO sign-in works without it; provisioning stays manual.

Domain verification keeps failing

The verification token expired (7-day validity), or the TXT record is missing on one of several listed domains. Request a fresh token in LocalCan, create the TXT record on every listed domain, and verify again. DNS propagation can take minutes to hours.

Still stuck?

Email support@localcan.com↗ with the timestamp of the failing Okta task and your team ID. Provisioning requests are logged on our side with per-request detail, so we can usually pinpoint the cause quickly.