Single sign-on (SSO) lets people log in to Certain with their organization's login, like Okta or Microsoft, instead of a Certain password. Certain sets up each SSO connection with your IT team. This article covers what you can check yourself when SSO isn't working. For how SSO is set up, see SSO (Single Sign-On) Configuration and Use.

Admin users: I can't log in with SSO

The login goes back to the login page, or says "User is inactive"

SSO only confirms who you are. You still need an active Certain user with your email address. If your user is missing or inactive, SSO sends you back to the login page.

• New to Certain? Ask your account admin to create a Certain user for you. SSO doesn't create one.
• Haven't logged in for a while? Certain sets users to inactive after 90 days without logging in. Ask your account admin to restore your user. They go to Account Settings > Administration > User Information, set Active to All, find your user, open it and click Restore.
• Your work email changed? Your Certain user may still have the old one. Ask your account admin to update it.

I log in and get an error, like a 403

Clear your browser's cache and cookies, close the browser and try again. If it still fails, contact Support with a screenshot of the error and the address in your browser.

Registrants: SSO on registration forms

Name or email didn't fill in

SSO only fills in the fields that are mapped for your SSO connection. Your account admin can see the mapping under Account Settings > Management > Single Sign-On. Open the connection to see which Certain fields each SSO field fills.

If your organization's SSO button is on your event website, registrants need to start there. Opening the registration form directly skips SSO, so nothing fills in.

The registrant's email changed after they logged in with SSO

SSO can replace an email the registrant typed with the one from your organization's login, which may be an old address. Each mapped field has an Editable checkbox under Account Settings > Management > Single Sign-On (open the connection and scroll to the field mapping). It controls how the SSO value and the value on the form work together.

The registration landed on the wrong profile

SSO finds an existing profile by one field, usually email. If your account has more than one profile with the same email, Certain uses the one updated most recently. Merging duplicate profiles fixes it. You can also require unique email addresses in the Registrant Details section of your forms.

A registrant can't log back in with SSO

• Someone who registered with one SSO can only log back in with that same SSO, or with their username and password. If they registered with LinkedIn, they can't log back in with Facebook.
• Someone who registered without SSO can only log back in with their username and password.

"Registration is not allowed to login catalog"

The registrant's registration status isn't one the session catalog allows. The event team needs to update their status. If you're the registrant, contact the event team.

Change the SSO button

Your account admin can change the button's label, color and icon under Account Settings > Management > Single Sign-On. Open the connection and edit the Button settings. They apply to every form, the mobile web app and the speaker and reviewer portals that use that connection.

If you have sub-accounts, each one has its own settings. If the button fields are greyed out, contact Support with the account name.

Setting up or changing an SSO connection

Certain sets up SSO connections with your IT team. To add a new one or change how it works, contact your Customer Success Manager. If your IT team uses ADFS, ask them to make sure it sends the user's User Principal Name (UPN).

Next step: Still stuck? Contact Support with the user's email, the time they tried to log in and a screenshot of what they saw.