# Troubleshooting

Your first stops: the **sync-status panel** on the LocalCan SSO settings page (last SCIM event, last successful SSO sign-in, members awaiting seats), your team's **audit log**, and the **Tasks** console in your Okta admin, where per-user provisioning errors land with the exact reason.

#### SSO error after Okta sign-in

The user authenticates at Okta but lands back on the LocalCan login page with an error banner. Two common causes:

- The app's **Single sign-on URL** or **Audience URI** still hold the setup placeholders, or no longer match your SSO settings page. Re-paste the **ACS URL** and **Audience URI** from LocalCan into the Okta app.
- The app's SAML signing certificate was rotated in Okta, so LocalCan holds a stale certificate. Contact [support@localcan.com](mailto:support@localcan.com) to update it. Okta app certs are ~10-year lived, so this is rare.

#### SSO error after clicking the Okta tile

SAML app tiles perform IdP-initiated sign-in, which LocalCan rejects by design. Hide the app icon and give users an Okta **Bookmark App** pointing at the LocalCan login page instead.

#### "User is not assigned to this application"

Okta blocks the sign-in before LocalCan is involved: the user (or their group) isn't assigned to the app. Assign the group to the app and confirm the user is in it.

#### Some users error during a bulk assignment

Their email domain isn't among the connection's verified domains (common when assigning everyone in the org), or the app's **Application username** isn't `Email`. Assign only users on verified domains, add the missing domain in LocalCan, or fix the username format. The Okta task shows the exact reason per user.

#### Exactly one user errors when offboarding

That user is the LocalCan **team owner**. IdP deprovisioning of the owner is refused; everyone else proceeds. Transfer ownership in LocalCan first, or remove the owner in LocalCan directly.

#### "Test Connector Configuration" fails

Usually a typo in the SCIM connector base URL. Re-paste the **SCIM base URL** exactly from the LocalCan SSO settings page.

#### Every SCIM request fails with 401

The bearer token is wrong or was rotated, or a leftover app from an earlier setup keeps pushing with a revoked token. Rotate the token in LocalCan, paste the new one into Okta, and deactivate leftover apps. The token panel's last-used time confirms Okta switched.

#### The Provisioning tab is missing or can't be set to SCIM

Your Okta org lacks the **Lifecycle Management** SKU. Contact your Okta account rep. SSO sign-in works without it; provisioning stays manual.

#### Domain verification keeps failing

The verification token expired (7-day validity), or the TXT record is missing on one of several listed domains. Request a fresh token in LocalCan, create the TXT record on **every** listed domain, and verify again. DNS propagation can take minutes to hours.

#### Still stuck?

Email [support@localcan.com](mailto:support@localcan.com) with the timestamp of the failing Okta task and your team ID. Provisioning requests are logged on our side with per-request detail, so we can usually pinpoint the cause quickly.