User Invitation Errors and SSO Integration Issues

Sending user invitations fails with error messages, or users provisioned through SSO (such as Okta) cannot access the instance properly after login, or there are issues with user provisioning workflows.

Note: For DataHub Cloud customers, infrastructure-level changes are managed by DataHub Support.

1. Verify invite configuration:

   • Check Settings → Settings (Admin) → Invite Configuration
   • Ensure SMTP settings are correct if using email invites
   • Verify the invite link base URL is set correctly

2. Troubleshoot SSO provisioning:

   • For Okta: Ensure user is assigned to the DataHub application in Okta
   • Check that email claim is being sent by IdP
   • Verify Just-In-Time (JIT) provisioning is enabled if required:

auth:
  oidc:
    enabled: true
    clientId: "${OKTA_CLIENT_ID}"
    clientSecret: "${OKTA_CLIENT_SECRET}"
    discoveryUri: "https://your-domain.okta.com/.well-known/openid-configuration"
    preProvisioning:
      enabled: true  # Enable JIT provisioning

3. Check user provisioning settings:

   • Verify user email addresses are correct
   • Ensure users are not already in the system with different email
   • Check for email domain restrictions in policies

4. Debug invite email sending:

   • Review DataHub GMS logs for email sending errors
   • Verify SMTP credentials and server accessibility
   • Test email delivery manually using the same SMTP settings

5. For Okta integration issues:

   • Confirm callback URLs are registered in Okta application
   • Check that groups claim is being sent if using group-based access
   • Review Okta system logs for authentication failures

Test configurations in a development environment before applying to production. Always backup configurations before making changes.

• DataHub Documentation

• 5718, 5893, 5730, 5929, 5781