Ping Identity SSO/SCIM email mismatch (original) (raw)

  1. All Collections
  2. Identity management (SSO, JIT, SCIM)
  3. Troubleshooting by identity provider
  4. Ping Identity SSO/SCIM email mismatch

Claude uses email as the primary identifier to match SSO logins to provisioned seats. Ping Identity products (PingOne and PingFederate) have flexible, layered attribute configuration. When SCIM provisioning and SAML/OIDC SSO pull from different user attributes, a mismatch blocks access.

Symptoms

People may experience one or more of the following when attempting to access your organization via SSO:

How this happens

Ping Identity products allow granular attribute mapping at multiple levels (directory, IdP adapter, SP connector, application). SCIM and SSO can each traverse different paths through these layers, resulting in different email values reaching Claude:

Claude requires an exact string match between the SCIM-provisioned email and the SSO-asserted email.

PingFederate note: PingFederate's attribute contract system is especially complex—email can pass through multiple layers (LDAP → IdP adapter → adapter contract → SP connector → assertion). A mismatch at any layer will cause the wrong value to reach Claude. Trace the value end-to-end.

Diagnostic steps

Step 1 — Confirm the mismatch (PingOne)

Step 1 (alternate) — Confirm the mismatch (PingFederate)

Step 2 — Identify the scope of the problem

Step 3 — Check attribute values for a specific person

Resolution

PingOne — Align both mappings to the email attribute

PingFederate — Align attribute contract across all layers

Trigger a full re-sync

Critical — Full sync required: An incremental sync will not update existing records after you change an attribute mapping. You must trigger a full restart of the provisioning cycle.

Post-fix cleanup

After correcting the attribute mapping and completing the full sync:

Verification

Common issues

When to contact Support

Contact our Support team with your organization's domain, the affected person's email, and screenshots of your attribute mappings when:

Related Articles

Google Workspace SSO/SCIM email mismatchMicrosoft Entra ID SSO/SCIM email mismatchOkta SSO/SCIM email mismatchOneLogin SSO/SCIM email mismatchPing Identity SSO setup