{"record":{"id":"7027bf52dc4766dd","repo":"n8n-io/n8n","slug":"sso-is-enabled-so-users-are-managed-by-the-identi","errorCode":null,"errorMessage":"SSO is enabled, so users are managed by the Identity Provider and cannot be added through invites","messagePattern":"SSO is enabled, so users are managed by the Identity Provider and cannot be added through invites","errorType":"exception","errorClass":"BadRequestError","httpStatus":400,"severity":"warning","filePath":"packages/cli/src/controllers/invitation.controller.ts","lineNumber":57,"sourceCode":"\t * Send email invite(s) to one or multiple users and create user shell(s).\n\t */\n\n\t@Post('/', { ipRateLimit: { limit: 10 } })\n\t@GlobalScope('user:create')\n\tasync inviteUser(\n\t\treq: AuthenticatedRequest,\n\t\t_res: Response,\n\t\t@Body invitations: InviteUsersRequestDto,\n\t) {\n\t\tif (invitations.length === 0) return [];\n\n\t\tconst isWithinUsersLimit = this.license.isWithinUsersLimit();\n\n\t\tif (isSsoCurrentAuthenticationMethod()) {\n\t\t\tthis.logger.debug(\n\t\t\t\t'SSO is enabled, so users are managed by the Identity Provider and cannot be added through invites',\n\t\t\t);\n\t\t\tthrow new BadRequestError(\n\t\t\t\t'SSO is enabled, so users are managed by the Identity Provider and cannot be added through invites',\n\t\t\t);\n\t\t}\n\n\t\tif (!isWithinUsersLimit) {\n\t\t\tthis.logger.debug(\n\t\t\t\t'Request to send email invite(s) to user(s) failed because the user limit quota has been reached',\n\t\t\t);\n\t\t\tthrow new ForbiddenError(RESPONSE_ERROR_MESSAGES.USERS_QUOTA_REACHED);\n\t\t}\n\n\t\tif (!(await this.ownershipService.hasInstanceOwner())) {\n\t\t\tthis.logger.debug(\n\t\t\t\t'Request to send email invite(s) to user(s) failed because the owner account is not set up',\n\t\t\t);\n\t\t\tthrow new BadRequestError('You must set up your own account before inviting others');\n\t\t}\n","sourceCodeStart":39,"sourceCodeEnd":75,"githubUrl":"https://github.com/n8n-io/n8n/blob/5ac6606e81f67bb9534255570cd4e86fd8101eee/packages/cli/src/controllers/invitation.controller.ts#L39-L75","documentation":"A BadRequestError (HTTP 400) from the invitation controller's inviteUsers endpoint. It fires when isSsoCurrentAuthenticationMethod() returns true, meaning the instance is configured for SAML/SSO as its sole identity provider. Because users are then provisioned by the IdP, the invite API is intentionally disabled. The same string is logged at debug level before throwing.","triggerScenarios":"POST to the invite endpoint (InviteUsersRequestDto body) while N8N_SSO_ENABLED / SAML is the active authentication method. Any invite attempt — even a single valid email — is rejected before the license or owner checks run.","commonSituations":"An admin enables SSO but the team still has bookmarked invite links or scripts that POST to /invite; a misconfigured SAML setup that the operator thought was optional but is actually the current method; migration from email invites to SSO where stale automation keeps firing.","solutions":["Stop using the invite API and provision users through your SAML/SSO Identity Provider instead.","If SSO was enabled by mistake, disable it (set the SSO/SAML config off) and restart n8n, then retry invites.","Remove or update any scripts, browser bookmarks, or browser extensions that still call the invite endpoint.","Confirm with isSsoCurrentAuthenticationMethod() / the Admin UI Settings > SSO page what the active method is."],"exampleFix":"// before: invite script run after SSO enabled\nawait api.post('/invite', [{ email, role: 'global:member' }]);\n\n// after: check auth method first\nconst settings = await api.get('/settings');\nif (settings.ssoEnabled) {\n  throw new Error('Provision via the Identity Provider; invites are disabled.');\n}\nawait api.post('/invite', [{ email, role: 'global:member' }]);","handlingStrategy":"validation","validationCode":"// Check the auth method before attempting invites.\nconst { ssoEnabled } = await api.get('/sso/config');\nif (ssoEnabled) {\n  throw new Error('Invites disabled — provision users via the IdP.');\n}","typeGuard":"function isInviteEnabled(state: { ssoEnabled: boolean; withinUsersLimit: boolean }): boolean {\n  return !state.ssoEnabled && state.withinUsersLimit;\n}","tryCatchPattern":"try {\n  await api.post('/invite', invites);\n} catch (e) {\n  if (e.response?.status === 400 && /SSO is enabled/.test(e.response.data.message)) {\n    notify('Provision users through the Identity Provider instead.');\n    return;\n  }\n  throw e;\n}","preventionTips":["Surface a UI banner that disables the Invite button when SSO is the active method.","Decommission invite scripts when migrating to SSO.","Re-check isSsoCurrentAuthenticationMethod() after config changes."],"tags":["invitations","sso","saml","rest-api","config"],"backgroundTag":null,"analyzedSha":"5ac6606e81f67bb9534255570cd4e86fd8101eee","analyzedAt":"2026-08-12T05:26:35.080Z","schemaVersion":2},"datasetVersion":"2026-08-13T09:17:06.757Z"}