Qlik Cloud login error via IDP: Multiple active users detected with the same e-mail, please contact your administrator

[Vinay_B]

When users try login for the first time via 3rd party Identity Provider, they see the error message below:

"{"errors":[{"title":"Multiple active users detected with the same e-mail, please contact your administrator","code":"LOGIN-12","status":"400"}],"traceId":"000000000000000081ed1151407942ba".

If some time has passed since the user was invited at the time Qlik ID was still in use, the following error may appear instead:

   "{"errors":[{"title":"User invitation expired","code":"USER_INVITE_EXPIRED","status":"403"}],"traceId":"000000000000000081ed1151407942bc".

Environment

• Qlik Cloud 
• Qlik Sense Business 

 

Resolution

The user likely has a pending invite. We need to temporarily disable the identity provide affected and delete the user's pending invite. Invites only show up when no Identity Provider is active on the system. We will need to temporarily disable the current IDP. During that brief time, users won't be able to login, but users that are already in the system will be able to work.

Solution 1: Manual

1. Go to your tenant's Management Console (example: https://YOURTENANT.REGION.qlikcloud.com/console)
   
   
2. Go to the Identity provider section in the  bottom left menu
   
   
   
   
   
3. Find your Identity Provider (IdP) and
   1. Click on the menu icon
   2. Deactivate the IdP
      
      
      
      NOTE: DO NOT LOG-OFF AT THIS STAGE, OR YOU MIGHT NOT BE ABLE TO LOG-IN AGAIN
      
      
4. Delete pending invites:
   
   1. Go to Users
   2. Select "Pending Invites" in the dropdown menu under "All Users"
   3.  Delete the invitation
      
      
      
      
5. Navigate to Identity Provider configuration and reactivate the previously disabled Identity Provider. 
   
   

Solution 2: Qlik CLI

You can use Qlik CLI to automate the process or to simply carry it out in a command line rather than in the Management Console. 

To get started with Qlik CLI, see: qlik-cli | Qlik Developer Portal.

1. List all users in the applicable context:
   
   Windows PowerShell:  qlik user ls --limit 100 --filter 'status eq \"invited\"'
   Linux/Mac: qlik user ls --limit 100 --filter 'status eq "invited"' 
   
   
   
   
2. Use the command below to delete the user(s) that were invited before the customers' IdP was configured:
   
   qlik user rm {id-of-invited-user} 
   
   Example: qlik user rm 63bc6ec0547b1037a8b914dd
   
   For information about the user remove command, see https://qlik.dev/toolkits/qlik-cli/user/user-rm 
   
   
3. Repeat per user as needed.

For information about the commands used, see:

qlik context | Qlik Developer Portal 
user ls | Qlik Developer Portal
user rm | Qlik Developer Portal

Cause:

The issue occurs to users who had received the invite to access the tenant via Qlik SSO or default identity provider Qlik ID and haven't actioned on the invite email. Once the invite is deleted, the issue will be resolved.

[srusu]

Hi, 

We're having this issue in our environment. However, in following the steps, nothing happens when clicking on the "Manage invites" button. I've tried sending the invite again, but even with that still nothing happens when I click the button.

Also, the icon is slightly different - but maybe it's just the icons update that happened not so long ago.

What could be happening?

Thanks,

Sorin.

[Sonja_Bauernfeind]

Hello @srusu 

Thank you for reporting this. I've reproduced similar behavior and reached out to our subject matter experts.  Will update you once I know more.

All the best,
Sonja 

[Sonja_Bauernfeind]

Hello @srusu 

Please log a support ticket to begin a proper investigation into this. You can mention my name and this article in it for extra history. Just click the CONTACT SUPPORT button in the bottom right corner and the bot can help you through the steps.

All the best,
Sonja