Organization Invitation Error "The specified account is not allowed to accept the current invitation"

When integrating an IDP-initiated login flow with Okta via SAML SSO using an invitation to an organization, the following error occurs:

{
    "error": "access_denied",
    "errorDescription": "the specified account is not allowed to accept the current invitation"
}

• SAML SSO
• Organization Invitation Error

This error occurs when a user attempts to use an invitation ticket with a different email than the one where the invite was sent.

When using an Organization invitation, the user needs to log in to an Identity Provider (IdP) that will return the same email address attribute as the email address on the invitation. If the correct account is being used, then the IdP may not be sending the email address in its response to Auth0, or the attribute being used to send the email attribute is not being mapped to the Auth0 profile's email attribute. 

In some cases, a SAML IdP may send the email as the NameID but not any other SAML attribute statements. In this case, it is possible to map the NameID to the email attribute in the SAML connection's mapping settings:

{
"email":"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier"
}

To check what the IdP is sending, enable the debug mode on the connection to add the SAML Response to the tenant log event for the login attempt. Alternatively, a HAR file can be captured from the end user to see the SAML response being returned to Auth0. Refer to Generate and Analyze HAR Files.

Once it is confirmed how the email address is being sent by the IdP, either modify the connection's mappings or request the IdP send the email attribute in its responses so it can be mapped.