Title: Login failure errors Author: WordPress VIP Documentation Published: November 15, 2023 Last modified: April 23, 2025 --- 1. [VIP Dashboard](https://docs.wpvip.com/vip-dashboard/) 2. [Log in to the VIP Dashboard](https://docs.wpvip.com/vip-dashboard/vip-dashboard-log-in/) 3. Login failure errors # Login failure errors For most issues that occur when attempting to [log in to the VIP Dashboard](https://docs.wpvip.com/vip-dashboard/vip-dashboard-log-in/) an informative error message will be returned. The error message will indicates a possible underlying cause for the issue. Users who receive a login failure error should share the error message with an Org admin. If an Org admin is unable to successfully troubleshoot an issue, they can [reach out to VIP Support](https://wordpressvip.zendesk.com/) for additional assistance. ## VIP Authentication login failure errors [VIP Authentication](https://docs.wpvip.com/vip-dashboard/vip-dashboard-log-in/vip-auth/) is required for users who sign in to the VIP Dashboard using either their GitHub user account or their WordPress.com user account for multi-factor authentication. Login failures when using this method can occur if: * An invitation to the email address associated with the third-party user account( i.e. GitHub or WordPress.com) that a user is trying to use for authentication was either never sent or has expired. A `VIPACCESS_001` error indicates that there is not currently a valid invitation to an organization for that email address. * The user attempts to authenticate with a third-party user account that is different than the one they used the first time they logged in. The GitHub and WordPress. com authentication methods cannot be used interchangeably. ## Single Sign-On (SSO) login failure errors Issues with SSO logins could be due to misconfigurations in the settings for the IdP, in the settings in the VIP Dashboard Single Sign-On panel, or a user attempting to login with an email address that is not recognized by the configured IdP. Org admins with access to both the settings for the configured identity provider( IdP) and the Single Sign-On panel for the VIP Dashboard are best able to investigate and potentially resolve these issues. Useful browser extensions that can assist with troubleshooting user attribute configurations: * [SAML-tracer browser extension for Firefox](https://addons.mozilla.org/en-US/firefox/addon/saml-tracer/) * [SAML Chrome panel extension for Chrome](https://chromewebstore.google.com/detail/saml-chrome-panel/paijfdbeoenhembfhkhllainmocckace?pli=1) ### VIPSSO_001: SSO Login Failure `Unable to authenticate your user via the identity provider.` The underlying cause for login failure is unknown and requires additional investigation. An Org admin should [reach out to VIP Support](https://wordpressvip.zendesk.com/) on behalf of the user and provide the following information: * The approximate time in UTC when the login attempt failed. * The email address submitted by the user. ### VIPSSO_002: SSO Invalid email `The email provided by your identity provider for your user appears to be invalid.` A valid email address must be mapped to the email attribute and provided during authentication. This can be caused by: * **Missing email attribute:** Verify that the exact value `https://schemas.wpvip. com/email` has been correctly added as the email attribute to the IdP’s configuration settings. * **Incorrect name for the email attribute:** Verify that the exact value `https:// schemas.wpvip.com/email` has been correctly added as the email attribute to the IdP’s configuration settings. Entering the email attribute as `email` is incorrect and will not work. * **Incorrect field mapped to the email attribute:** Verify that the user’s primary email address field is mapped to the email attribute `https://schemas.wpvip.com/ email` in the IdP’s configuration settings. * **A misspelling in the user’s email address:** Verify the spelling of the user’s email address in the IdP’s configuration settings and make any necessary corrections. ### VIPSSO_003: SSO Invalid name `The name provided by your identity provider for your user appears to be invalid.` During authentication the value mapped to the full name attribute is used if it is available. If it is not available, the first name and last name attributes are used, joined by a space. The “Invalid name” error can be caused by: * **Incorrect name for the full name attribute:** Verify that the exact value ` https://schemas.wpvip.com/name` has been correctly added as the full name attribute to the IdP’s configuration settings. Entering `name` for this value is incorrect and will not work. * **Incorrect name for the first name and/or last name attribute:** When applicable, verify that the exact value `https://schemas.wpvip.com/firstname` has been correctly added as the first name attribute in the IdP’s configuration settings, and `https:// schemas.wpvip.com/lastname` has been added for the last name attribute. Entering` firstname` or `lastname` for these values is incorrect and will not work. * **Incorrect field mapped to the first name and/or last name attribute:** Verify in the IdP settings that the user’s first name field is mapped to the first name attribute `https://schemas.wpvip.com/firstname` and the last name field is mapped to the last name attribute `https://schemas.wpvip.com/lastname`. * **A misspelling in the user’s name field:** Verify the spelling of the user’s full name in the IdP’s configuration settings and make any necessary corrections. * **A missing value or misspelling in the user’s first or last name fields:** Verify the spelling of the user’s first and/or last name in the IdP’s configuration settings and make any necessary corrections. These fields must not be empty nor contain an email address. ### VIPSSO_004: SSO certificate error `Unable to validate the signed response using the Signing Certificate (X.509 Certificate).` The signing certificate added to this organization’s SSO configuration is invalid. This could be caused by: * An incorrect certificate added to the SSO configuration. * A certificate that expired after being added to the SSO configuration. * A certificate that was rotated on the IdP but was not updated on the VIP Dashboard SSO configuration. ### VIPSSO_005: SSO Request Denied `The identity provider denied access to the VIP Dashboard for your user.` The user attempting to log in was not added by the organization to the IdP. ### VIPSSO_006: SSO Entity ID mismatch `The Entity ID in the request does not match the Entity ID in the response.` The Entity ID value is a globally unique name for the service provider (WPVIP) that enables the IdP to recognize the WPVIP entity. The IdP might use different terminology to refer to this value such as “Audience URI” or “Audience Restriction”. Verify that the Entity ID value entered in the IdP settings matches the value provided in [the “SSO URL and Entity ID” section of the **Single-Sign On** panel](https://docs.wpvip.com/vip-dashboard/organization-view/sso/configurations/#SSO-URL-and-Entity-ID) of the organization’s VIP Dashboard. ### VIPSSO_007: SSO Identity provider initiated logins not permitted `Logins must be initiated from the VIP Dashboard. Logins initiated from the identity provider are not supported.` Once SSO configuration is complete, some IdPs might offer the ability to log in to the VIP Dashboard from the IdP’s dashboard. This method is not supported and will fail. SSO logins must be initiated from `https://dashboard.wpvip.com/` or from the **Login URL** provided in an organization’s **Single Sign-On** panel. Last updated: April 23, 2025