A sign-in that does not complete always ends on a page with a sentence. The person signing in sees a short message. The organization's Admin sees a reason in Settings. This page lists both.
If you are signing in
Find your message. If the next step is your Admin's, send them the message and the time you tried.
| Message | What it means | Next step |
|---|---|---|
| "This sign-in request has expired or was already used. Start sign-in again." | The sign-in took longer than ten minutes, was opened twice, or finished in a different browser. | Start again, and stay in one browser window until you are back in Tamaat. |
| "Company sign-in is unavailable. Contact your organization’s administrator." | Tamaat could not complete the sign-in with your organization's identity provider. Nothing is wrong with your account. | Tell your Admin. |
| "Company sign-in is unavailable. Contact your organization’s administrator and include support code …" | The same, with a code that leads your Admin to the reason. | Send your Admin the code. |
| "You signed in, but this account has not been invited to that organization. Ask an Admin for an invitation." | Your company account worked. You are not a member of the organization in Tamaat, or you have not yet opened your invitation. | If you hold an invitation and have no Tamaat account yet, open the link in the invitation email and sign in from there. Otherwise ask an Admin of the organization to invite you. |
| "Your organization signed you in with a different email address than the one invited. Ask for a new invitation." | The invitation went to one address; your organization knows you by another. | Ask the Admin to invite the address you sign in with at work. |
| "Your organization’s sign-in does not open this." | You signed in, and this map or dashboard is not open to your organization's sign-in. | Ask whoever sent you the link to give you access. |
| "Your organization’s sign-in could not confirm who you are for this." | Your organization's identity provider did not send something Tamaat needs here, such as your email address or when you signed in; or your email address is not on a domain your organization has verified; or you are not in a group this map or dashboard asks for. | Tell your Admin. They check the provider's settings, Domains under Single sign-on, and the groups named on the map or dashboard. |
| "Your organization's sign-in does not show that you can open this." | The map or dashboard is open to certain groups, and your sign-in did not show you in one of them. | Ask whoever published it which group you need. |
| "This account has been deactivated." | Your Tamaat account is switched off. | Contact the Admin who manages your account. |
| "Use the sign-in address your organization gave you." | Your work email did not lead to an organization's sign-in. | Use the address your organization gave you, or sign in with your password. |
| "That code is not right. Check the email and try again." | The six-digit code did not match. | Type it again from the newest email. |
| "This sign-in has ended. Start again." | The code ran out after ten minutes, or was mistyped too often. | Start the sign-in again for a new code. |
| "You are signed in, but the accounts could not be linked." | You are in with your password. Your company account was not joined to it. | Choose "Continue", then try your organization's sign-in again later. |
| "This organization’s sign-in is not available. Open the map link again." | The sign-in for a published map could not start. | Open the link you were given again. |
Three prompts are not errors. They ask you to choose:
- "Link your accounts?", "Check your email" and "Another account is signed in on this browser." are explained in Sign In With Your Organization.
- "Sign in with your organization" and "Sign in with your password", appearing while you work, are explained there too.
If you are the Admin
Open Settings, Organization → Single sign-on, and scroll to Activity. Each sign-in is a line with "When", "Event", "Who" and "Support code". A sign-in that failed reads "Sign-in refused" or "Sign-in not started", with the reason beneath it.
A failed "Test connection" shows the same reasons on its result page.
The person
| Reason | Next step |
|---|---|
| "This person has not been invited to the organization. Invite them, then ask them to sign in again." | Invite them under Members & sharing. |
| "The identity provider says this person’s email address is not verified. Verify it at your provider, then ask them to sign in again." | Verify the address at your provider. |
| "Sign-in through this connection is turned off for this person." | Their link to this connection is not in use. If they should have access, choose "Remove link" for them under People and ask them to sign in again. |
| "This person’s account is deactivated or deleted." | Their Tamaat account cannot be used. |
| "Another account was already signed in on that browser. The person signs out there, then signs in again." | Ask them to sign out of Tamaat and start again. |
| "Too many sign-in codes were sent to this person’s email address in an hour. They can try again later." | Wait an hour. Five codes an hour is the limit. |
Start again
These mean one sign-in went wrong, not that anything is set up badly. The person starts again.
- "The sign-in finished in a different browser from the one that started it. Start again and stay in one browser."
- "The sign-in request expired or was already used. Start sign-in again."
- "The response did not match a sign-in we started. Start sign-in again."
- "The response did not belong to this sign-in. Start sign-in again."
- "The connection’s settings changed during the sign-in. Start sign-in again."
- "The identity provider sent the person back without completing the sign-in. Start sign-in again."
- "You signed out or signed in again while the organization’s sign-in was open. Start it again from the app."
If one person meets these repeatedly, check that they are not switching browsers, and that a mail or security tool is not opening their links first.
The connection's settings
Something in the connection does not match your provider. Choose "Edit" on the connection, correct it, then "Save and test".
| Reason | What to check |
|---|---|
| "The identity provider refused our request. Check the client ID, the client secret and the redirect URI." | All three, against the application at your provider. Copy the "Redirect URI" again. |
| "The identity provider could not be reached. Check the issuer address, then try again." | The "Issuer", and that your provider answers from outside your network. |
| "The identity provider’s answer could not be read. Check the issuer address." | The "Issuer". |
| "The provider’s discovery document names a different issuer. Check the issuer address." | The "Issuer" must match your provider's own, character for character. |
| "The provider’s discovery document is missing addresses we need. Check the issuer, or enter the discovery document address." | Under "Advanced", enter the "Discovery document address (optional)". |
| "The identity provider gave an address that cannot be used. It must give https addresses." | Your provider must answer over https. |
| "The response came from a different issuer. Check the issuer address." | The "Issuer". |
| "The response was for a different application. Check the client ID." | The "Client ID". |
| "No client secret is saved for this connection. Replace the secret." | Choose "Replace secret". |
| "The saved client secret could not be read. Replace the secret." | Choose "Replace secret". |
A client secret that has run out at your provider gives the first reason in this table. The connection shows the date under "Client secret" if you entered one.
What your provider sends
These are settings on the application at your provider, not in Tamaat.
| Reason | What to change at your provider |
|---|---|
| "The identity provider declined the sign-in. Check that this person is assigned to the application there." | Assign the person, or their group, to the application. |
| "The provider did not say who signed in. Check that the application uses OpenID Connect." | The application type. |
| "The response did not include a permanent ID for the person. Check what your provider sends for this application." | What the application sends about a person. |
| "The response was signed with a method we do not accept. Set the application to sign with RS256, PS256 or ES256." | The signing method. |
| "The key that signed the response is not one the provider publishes. Try again in a few minutes." | Nothing; your provider is changing its keys. Try again. |
| "The response’s signature is not valid. Check the issuer address." | The "Issuer" in Tamaat. |
| "The response had already expired. Check the clock at your identity provider, then try again." | The clock on your provider. |
| "The response was dated in the future. Check the clock at your identity provider, then try again." | The clock on your provider. |
| "The response could not be read. Check the application’s settings at your provider." | The application's settings. |
Anything else
"We could not complete the sign-in. Try again, or contact support with the support code." and "The sign-in did not complete. Try again, or contact support with the support code." are shown when Tamaat has no more specific sentence. If the person was accepting an invitation or opening a published map or dashboard, check three things first: the invitation went to the address they sign in with, their email domain is verified under Domains, and the connection's last test shows "Sign-in time received". Otherwise try once more. If it repeats, see Support codes below.
Messages while you change the settings
| Message | Next step |
|---|---|
| "Only an Admin of this organization can change its single sign-on settings." | Ask an Admin. |
| "Single sign-on starts on the Professional plan." | Change plan under Plan & billing. Turning things off never needs the plan. |
| "Test the saved connection before you enable it." | Choose "Test connection". A test of an earlier version does not count. |
| "Enable a connection before you allow single sign-on." | Enable one, then choose Optional. |
| "Single sign-on cannot be required yet. Finish the items that are not ready." | See Require Single Sign-On. |
| "These settings changed. Refresh and try again." | Another Admin changed them. Reload the page. |
| "This organization already has as many connections as it can have. Remove one first." | Five is the limit. Remove one you no longer use. |
| "This identity provider address cannot be used. Use the https address your provider gives you." | Use the provider's https address. |
| "Another organization has already verified this domain." | A domain leads to one organization. |
| "We could not find the DNS record yet. It can take a while to appear. Try again later." | Check the record's name and value, then "Check now" again later. |
| "We could not check the DNS record right now. Try again shortly." | Choose "Check now" again. |
Support codes
Lines in Activity carry a support code. When "Company sign-in is unavailable" names a code, the person sees the same one, so they can send it to you and you can find the line.
When you ask Tamaat for help, send:
- the support code,
- the time of the sign-in,
- the provider you chose for the connection, and
- the reason shown in Activity.
Do not send a client secret, a password, or a code from an email. Nobody needs them to find the problem.
Next steps