3830674 - “Sorry, we could not authenticate you. Try again.” Error for Onboardee Due to Missing RBP Permissions – Onboarding

• An onboardee is successfully synced to Identity Authentication (IAS) but cannot access the login page.
• Resetting the user's password does not resolve the login issue.
• The following error is displayed: “Sorry, we could not authenticate you. Try again.”
• The issue may occur for a specific onboardee while other onboardees can log in successfully.

SAP SuccessFactors Onboarding

1. Navigate to the candidate SSO login page.
2. Enter the personal email and password.
3. Attempt to log in using the onboardee's IAS account.
4. Submit and observe that access fails with “Sorry, we could not authenticate you. Try again.”
5. Reset the user's password and attempt to log in again.
6. Observe that the login issue persists.

The affected onboardee does not have the required Role-Based Permissions (RBP), including the User Login permission required to log in.

In Provisioning → Company SSO Settings → SSO Log Viewer, the following entry may be observed:

User doesn't have login permission @sf_loaduser.

The affected user's RBP configuration should be compared with a working onboardee. In the reported scenario, the affected user had no assigned roles/permissions, while the working onboardee was included in the OnboardingExternalUser group with the required permissions.

1. Navigate to RBP Troubleshooting and verify the roles and permissions assigned to the affected onboardee.
2. Ensure the onboardee is added to the appropriate user group, such as OnboardingExternalUser, where the required permissions are granted.
3. Verify that the User Login permission is granted, as this permission is required for the user to log in successfully.
4. If required, manually add the onboardee to the appropriate group or update the relevant RBP configuration.
5. Once the required permissions are confirmed, reset the user's password from the IAS Console.
6. Test the login again.

• KBA 3620517 - Real-Time Sync/Integration Service registration refresh for IAS/IPS
• KBA 3073296 - The user cannot login to Identity Authentication after sync job in Identity Provisioning
• KBA 3657586 - Onboardee cannot login: "Invalid user or password"
• KBA 3641882 - Candidates can reset IAS password but get "Invalid Login" in SuccessFactors
• KBA 3440428 - "Invalid Login" via IAS
• KBA  3502822 - "Invalid Login" even if login parameters are correct
• Implementation guide – Manage Real-Time Sync of new hires to IAS with IPS

onboarding login failure, IAS SSO, MFA completed cannot login, sorry we could not authenticate you, invalid login, user doesn't have login permission, RBP troubleshooting, User Login permission, onboarding external user group, execution manager in progress, real-time sync, integration service registration center, identity provisioning service, ips read job, candidate portal access , KBA , LOD-SF-OBX-IAS , IAS User Authentication , Problem