Symptom
- An onboardee is successfully synced to Identity Authentication (IAS) but cannot log in.
- The onboardee receives the password-change email and successfully changes the password.
- Login continues to fail with the following error:
“We couldn't log you in. Please contact your system administrator. Error: Invalid Login. Your account may be locked, inactive, or not included in the default user group. If your organization uses SSO, it may not be working correctly”.
Environment
SAP SuccessFactors Onboarding
Reproducing the Issue
- Sync an onboardee from Onboarding to IAS.
- Complete the account activation/password change process.
- Make multiple unsuccessful login attempts for the onboardee account.
- Attempt to log in again with the correct/new password.
- Observe that login fails with an Invalid Login error.
Cause
The onboardee's IAS external user account is in a Blocked status, preventing the user from logging in even after successfully changing the password.
Resolution
- Navigate to Reset User Accounts.
- Under External Users from Onboarding and/or Learning (if Learning is enabled), search for the affected onboardee using the username.
- Verify the user's account status.
- If the account is Blocked, use the available reset/unblock option to unblock the account.
- Reset the password and have the onboardee attempt to log in again using the updated password.
If the account is not blocked or the issue persists after unblocking, further investigation may be required, including validation of the IAS/SAML login flow.
See Also
Keywords
onboardee login, invalid login, ias password reset, identity authentication, real-time sync, onboarding access, cannot sign in, provisioning, external user, sso login, password changed cannot login, execution manager logs, login error, user inactive, default user group , KBA , LOD-SF-OBX-IAS , IAS User Authentication , Problem
SAP Knowledge Base Article - Public