{"record":{"id":"46902ee780a1af5a","repo":"n8n-io/n8n","slug":"invite-links-are-not-supported-on-this-system-ple-46902e","errorCode":null,"errorMessage":"Invite links are not supported on this system, please use single sign on instead.","messagePattern":"Invite links are not supported on this system, please use single sign on instead\\.","errorType":"exception","errorClass":"BadRequestError","httpStatus":400,"severity":"warning","filePath":"packages/cli/src/controllers/invitation.controller.ts","lineNumber":173,"sourceCode":"\t/**\n\t * Fill out user shell with first name, last name, and password using JWT token.\n\t */\n\t@Post('/accept', {\n\t\tskipAuth: true,\n\t\t// Two layered rate limit to ensure multiple users can accept an invitation from\n\t\t// the same IP address but aggressive per inviteeId limit.\n\t\tipRateLimit: { limit: 100, windowMs: 1 * Time.minutes.toMilliseconds },\n\t})\n\tasync acceptInvitationWithToken(\n\t\treq: AuthlessRequest,\n\t\tres: Response,\n\t\t@Body payload: AcceptInvitationRequestDto,\n\t) {\n\t\tif (isSsoCurrentAuthenticationMethod()) {\n\t\t\tthis.logger.debug(\n\t\t\t\t'Invite links are not supported on this system, please use single sign on instead.',\n\t\t\t);\n\t\t\tthrow new BadRequestError(\n\t\t\t\t'Invite links are not supported on this system, please use single sign on instead.',\n\t\t\t);\n\t\t}\n\n\t\tif (!payload.token) {\n\t\t\tthis.logger.debug('Request to accept invitation failed because token is missing');\n\t\t\tthrow new BadRequestError('Token is required');\n\t\t}\n\n\t\tconst { firstName, lastName, password } = payload;\n\n\t\t// Extract inviterId and inviteeId from JWT token\n\t\tconst { inviterId, inviteeId } = await this.userService.getInvitationIdsFromPayload(\n\t\t\tpayload.token,\n\t\t);\n\n\t\treturn await this.processInvitationAcceptance(\n\t\t\tinviterId,","sourceCodeStart":155,"sourceCodeEnd":191,"githubUrl":"https://github.com/n8n-io/n8n/blob/5ac6606e81f67bb9534255570cd4e86fd8101eee/packages/cli/src/controllers/invitation.controller.ts#L155-L191","documentation":"A BadRequestError (HTTP 400) from acceptInvitationWithToken when isSsoCurrentAuthenticationMethod() is true. Once the instance routes all authentication through SSO, invite-link-based signup is disabled because passwords are managed by the IdP. This is the token-acceptance counterpart of the invite-creation SSO block.","triggerScenarios":"POST to the accept-invitation endpoint with an AcceptInvitationRequestDto while SSO/SAML is the current authentication method. The check is the first guard in the handler, before token validation.","commonSituations":"SSO was enabled after invites were sent; users received invite emails before the cutover and click them post-cutover; bookmarked invite links used after migration to SAML.","solutions":["Direct the user to sign in via the SSO/Identity Provider instead of the invite link.","If SSO was enabled in error, disable it and restart n8n, then the invite link will work again.","Re-issue invites only after confirming SSO is off, or provision users through the IdP."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Check SSO state before showing the accept-invite UI.\nconst { ssoEnabled } = await api.get('/sso/config');\nif (ssoEnabled) {\n  redirect('/sso/login');\n}","typeGuard":"function isSsoActive(c: { ssoEnabled: boolean }): boolean {\n  return c.ssoEnabled === true;\n}","tryCatchPattern":"try {\n  await api.post('/accept-invitation', payload);\n} catch (e) {\n  if (e.response?.status === 400 && /single sign on/i.test(e.response.data.message)) {\n    redirect('/sso/login');\n    return;\n  }\n  throw e;\n}","preventionTips":["Hide the accept-invite page and redirect to SSO login once SSO is enabled.","Send invite emails only when SSO is off, otherwise provision via the IdP.","Communicate the cutover to users so they stop using old invite links."],"tags":["invitations","sso","saml","token","rest-api"],"backgroundTag":null,"analyzedSha":"5ac6606e81f67bb9534255570cd4e86fd8101eee","analyzedAt":"2026-08-12T05:26:35.080Z","schemaVersion":2},"datasetVersion":"2026-08-12T18:17:37.767Z"}