n8n-io/n8n · warning · BadRequestError

SSO is enabled, so users are managed by the Identity Provide

Error message

SSO is enabled, so users are managed by the Identity Provider and cannot be added through invites

What it means

A BadRequestError (HTTP 400) from the invitation controller's inviteUsers endpoint. It fires when isSsoCurrentAuthenticationMethod() returns true, meaning the instance is configured for SAML/SSO as its sole identity provider. Because users are then provisioned by the IdP, the invite API is intentionally disabled. The same string is logged at debug level before throwing.

Source

Thrown at packages/cli/src/controllers/invitation.controller.ts:57

	 * Send email invite(s) to one or multiple users and create user shell(s).
	 */

	@Post('/', { ipRateLimit: { limit: 10 } })
	@GlobalScope('user:create')
	async inviteUser(
		req: AuthenticatedRequest,
		_res: Response,
		@Body invitations: InviteUsersRequestDto,
	) {
		if (invitations.length === 0) return [];

		const isWithinUsersLimit = this.license.isWithinUsersLimit();

		if (isSsoCurrentAuthenticationMethod()) {
			this.logger.debug(
				'SSO is enabled, so users are managed by the Identity Provider and cannot be added through invites',
			);
			throw new BadRequestError(
				'SSO is enabled, so users are managed by the Identity Provider and cannot be added through invites',
			);
		}

		if (!isWithinUsersLimit) {
			this.logger.debug(
				'Request to send email invite(s) to user(s) failed because the user limit quota has been reached',
			);
			throw new ForbiddenError(RESPONSE_ERROR_MESSAGES.USERS_QUOTA_REACHED);
		}

		if (!(await this.ownershipService.hasInstanceOwner())) {
			this.logger.debug(
				'Request to send email invite(s) to user(s) failed because the owner account is not set up',
			);
			throw new BadRequestError('You must set up your own account before inviting others');
		}

View on GitHub (pinned to 5ac6606e81)

Solutions

1. Stop using the invite API and provision users through your SAML/SSO Identity Provider instead.
2. If SSO was enabled by mistake, disable it (set the SSO/SAML config off) and restart n8n, then retry invites.
3. Remove or update any scripts, browser bookmarks, or browser extensions that still call the invite endpoint.
4. Confirm with isSsoCurrentAuthenticationMethod() / the Admin UI Settings > SSO page what the active method is.

Example fix

// before: invite script run after SSO enabled
await api.post('/invite', [{ email, role: 'global:member' }]);

// after: check auth method first
const settings = await api.get('/settings');
if (settings.ssoEnabled) {
  throw new Error('Provision via the Identity Provider; invites are disabled.');
}
await api.post('/invite', [{ email, role: 'global:member' }]);

// Check the auth method before attempting invites.
const { ssoEnabled } = await api.get('/sso/config');
if (ssoEnabled) {
  throw new Error('Invites disabled — provision users via the IdP.');
}

function isInviteEnabled(state: { ssoEnabled: boolean; withinUsersLimit: boolean }): boolean {
  return !state.ssoEnabled && state.withinUsersLimit;
}

try {
  await api.post('/invite', invites);
} catch (e) {
  if (e.response?.status === 400 && /SSO is enabled/.test(e.response.data.message)) {
    notify('Provision users through the Identity Provider instead.');
    return;
  }
  throw e;
}

When it happens

Trigger: POST to the invite endpoint (InviteUsersRequestDto body) while N8N_SSO_ENABLED / SAML is the active authentication method. Any invite attempt — even a single valid email — is rejected before the license or owner checks run.

Common situations: An admin enables SSO but the team still has bookmarked invite links or scripts that POST to /invite; a misconfigured SAML setup that the operator thought was optional but is actually the current method; migration from email invites to SSO where stale automation keeps firing.

Related errors

• Invite links are not supported on this system, please use si
• You must set up your own account before inviting others
• ${ssoIdentity.providerType.toUpperCase()} user may not chang
• SAML user may not change their email
• Maximum number of users reached

AI-assisted analysis of n8n-io/n8n@5ac6606e81 (2026-08-12). Data as JSON: /api/errors/7027bf52dc4766dd. Report an issue: GitHub.