# Login error
**URL:** https://meta.discourse.org/t/login-error/270564
**Category:** SSO
**Created:** [July 5, 2023, 12:36am UTC](https://meta.discourse.org/t/login-error/270564 "2023-07-05T00:36:13Z")
**Posts on this page:** 19
**Page:** 1
### Author:  [@klein](https://meta.discourse.org/u/klein)
#### Post date: [July 5, 2023, 12:36am UTC](https://meta.discourse.org/t/login-error/270564/1 "2023-07-05T00:36:13Z")
Hello everyone! One of my forum users couldn’t use his account to login forum from our website and got this error. There is no problem with other user accounts but only his. I thought it maybe can be solved by updating forum to the newest version but the problem is still there.
Do you have any idea? I appreciate any help.
---
### Author:  [@JammyDodger](https://meta.discourse.org/u/JammyDodger)
#### Post date: [July 5, 2023, 4:25am UTC](https://meta.discourse.org/t/login-error/270564/3 "2023-07-05T04:25:19Z")
Is there anything special about your login setup, or about this user in particular? I think I’ve seen similar errors concerning admin accounts previously, but the more information you can provide the better. :+1:
Are you seeing any errors in your `/logs`?
---
### Author:  [@klein](https://meta.discourse.org/u/klein)
#### Post date: [July 5, 2023, 7:14pm UTC](https://meta.discourse.org/t/login-error/270564/6 "2023-07-05T19:14:40Z")
Thank you for your reply!
Do you mean logs at `/var/discourse/shared/standalone/log/rails`?
In which log is such error recorded?
`production.log` or `production_errors.log`
the second one is empty.
---
### Author:  [@JammyDodger](https://meta.discourse.org/u/JammyDodger)
#### Post date: [July 5, 2023, 7:48pm UTC](https://meta.discourse.org/t/login-error/270564/7 "2023-07-05T19:48:03Z")
I meant the logs at `[YourSite]/logs`, or possibly if anything shows up in the browser console when they attempt to login? There may be some extra detail there that could help narrow it down.
Are they a non-staff user, and do you have any SSO enabled?
---
### Author:  [@klein](https://meta.discourse.org/u/klein)
#### Post date: [July 5, 2023, 8:35pm UTC](https://meta.discourse.org/t/login-error/270564/8 "2023-07-05T20:35:08Z")
Yes i guess all user can login with sso, because they don’t need to enter account and password again to login forum. They are directly transfered from the website to the forum.
This is error in console:
And this is a possible error log in the web:
ActiveRecord::RecordInvalid (validation failed: Primary email already adopted) app/models/discourse\_connect.rb:270:in `block in match_email_or_create_user' lib/distributed_mutex.rb:53:in `block in synchronize’ lib/distributed
---
### Author:  [@JammyDodger](https://meta.discourse.org/u/JammyDodger)
#### Post date: [July 6, 2023, 8:52am UTC](https://meta.discourse.org/t/login-error/270564/9 "2023-07-06T08:52:53Z")
I think it seems this particular user has a different email on Discourse than they do on your main site. Could you check that to confirm?
---
### Author:  [@klein](https://meta.discourse.org/u/klein)
#### Post date: [July 6, 2023, 11:16am UTC](https://meta.discourse.org/t/login-error/270564/10 "2023-07-06T11:16:59Z")
Yes, I just checked the Email showed on Discourse User panel and the Email on our main site, they are the same.
---
### Author:  [@JammyDodger](https://meta.discourse.org/u/JammyDodger)
#### Post date: [July 6, 2023, 12:08pm UTC](https://meta.discourse.org/t/login-error/270564/11 "2023-07-06T12:08:24Z")
I have had a scout about and one possible reason could be that their email has accidentally made its way onto your blocked list. You can search and see if that’s the case on your `/admin/logs/screened_emails` page. If you find it on there, unblocking it may do the trick. :+1: (also worth checking for their IP in `/admin/logs/screened_ip_addresses` too)
If that’s not the case, another possibility is that they had a forum account before you enabled SSO. What SSO are you using?
---
### Author:  [@klein](https://meta.discourse.org/u/klein)
#### Post date: [July 6, 2023, 1:07pm UTC](https://meta.discourse.org/t/login-error/270564/12 "2023-07-06T13:07:54Z")
I checked /admin/logs/screened\_ip\_addresses and it’s empty.
Sorry, I don’t understanding what you mean. (“What SSO are you using”) Are there many types of SSO?
---
### Author:  [@JammyDodger](https://meta.discourse.org/u/JammyDodger)
#### Post date: [July 6, 2023, 2:10pm UTC](https://meta.discourse.org/t/login-error/270564/13 "2023-07-06T14:10:53Z")
I was wondering if you’d used [Discourse Connect](https://meta.discourse.org/t/13045?silent=true) or something else, and what you’d connected it to provide your user authentication (Wordpress, for instance).
---
### Author:  [@RGJ](https://meta.discourse.org/u/RGJ)
#### Post date: [July 6, 2023, 2:18pm UTC](https://meta.discourse.org/t/login-error/270564/14 "2023-07-06T14:18:49Z")
We’ve seen this error before, I just did a search on our ticketing system.
This happens when you have
- require activation set to true
- a user U1 on Discourse with a specific email address, possibly with external ID A.
- a user U2 on the [DiscourseConnect](https://meta.discourse.org/t/13045?silent=true) provider side with the same email address and a different external ID (B)
The user logs in, Discourse checks if there is a user with external ID B, it does not exist.
Normally Discourse will perform a match on email as a next step but since require activation is set the email address is untrusted and it [skips](https://github.com/discourse/discourse/blame/250e3d881d6fcad6de55d483c891273a678faaf8/app/models/discourse_connect.rb#L250) this step and it will not associate with user U1 because it would allow for [account hijacking](https://github.com/discourse/discourse/commit/e64402cb3beef7a52b235133a35005c0ab51cb96).
So Discourse decides to create a new user. That fails because user U1 already exists with that email address.
It would be good if there was a better error in case the email does exist but the email is untrusted. I’m also unsure why it shows a generic Rails error.
Resolutions:
- if your email addresses on [DiscourseConnect](https://meta.discourse.org/t/13045?silent=true) provider side are verified and can be trusted, set require activation to false.
or
- change the external ID for user U1 to B
or
- change the email address for user U1 to something else
Adding the text “the change you wanted was rejected” so this topic will be found when someone searches for this error.
---
### Author:  [@klein](https://meta.discourse.org/u/klein)
#### Post date: [July 10, 2023, 9:31pm UTC](https://meta.discourse.org/t/login-error/270564/15 "2023-07-10T21:31:28Z")
Yes, we are using [Discourse connect](https://meta.discourse.org/t/13045?silent=true) and it is connected to our site.
---
### Author:  [@klein](https://meta.discourse.org/u/klein)
#### Post date: [July 10, 2023, 9:38pm UTC](https://meta.discourse.org/t/login-error/270564/16 "2023-07-10T21:38:28Z")
Thank you very much for your detailed reply! The email addresses in our site are verified when user login. So I will try to fix the problem with method 1 firstly. But in the admin settings I didn’t find where “require email activation” is.
---
### Author:  [@RGJ](https://meta.discourse.org/u/RGJ)
#### Post date: [July 10, 2023, 10:02pm UTC](https://meta.discourse.org/t/login-error/270564/17 "2023-07-10T22:02:30Z")
It’s a parameter sent back during the SSO process, see [Disable email verification for SSO - #4 by simon](https://meta.discourse.org/t/disable-email-verification-for-sso/148086/4)
---
### Author:  [@simon](https://meta.discourse.org/u/simon)
#### Post date: [July 10, 2023, 10:35pm UTC](https://meta.discourse.org/t/login-error/270564/18 "2023-07-10T22:35:17Z")
> [@RGJ](#):
>
> Resolutions:
For sites that are using the [WP Discourse](https://github.com/discourse/wp-discourse) plugin for authentication, site admins can also mark email addresses for _individual_ users as verified from the user’s preferences page:
This is safer, and easier, than disabling email verification for all users on the site.
> [@RGJ](#):
>
> We’ve seen this error before
I wonder when this started happening. I’m fairly sure the scenario you’re outlining used to generate this error message: “There is a problem with your account. Please contact the site’s administrator.”
---
### Author:  [@RGJ](https://meta.discourse.org/u/RGJ)
#### Post date: [July 11, 2023, 7:05am UTC](https://meta.discourse.org/t/login-error/270564/19 "2023-07-11T07:05:09Z")
> [@simon](#):
>
> I wonder when this started happening
[Here](https://meta.discourse.org/t/setting-min-username-length-greater-than-5-breaks-granting-and-revoking-admin-moderator-permissions/57079) is another case of a failing Rails validator that returns this error, and it’s 6.5 years old. In the context of [DiscourseConnect](https://meta.discourse.org/t/13045?silent=true) this indeed is something we’ve only seen in the past few months.
---
### Author:  [@klein](https://meta.discourse.org/u/klein)
#### Post date: [July 11, 2023, 8:17am UTC](https://meta.discourse.org/t/login-error/270564/20 "2023-07-11T08:17:07Z")
We are using the discourse image, so should we just add `require_activation=true` in `env:`?
---
### Author:  [@klein](https://meta.discourse.org/u/klein)
#### Post date: [July 11, 2023, 8:19am UTC](https://meta.discourse.org/t/login-error/270564/21 "2023-07-11T08:19:33Z")
Thank you for your help, but we don’t sue WP. We are using discourse docker image. The proper way to configure it is adding `require_activation=true` in `env:` of the app.yml file?
---
### Author:  [@RGJ](https://meta.discourse.org/u/RGJ)
#### Post date: [July 11, 2023, 2:55pm UTC](https://meta.discourse.org/t/login-error/270564/22 "2023-07-11T14:55:42Z")
No, see [Login error - #17 by RGJ](https://meta.discourse.org/t/login-error/270564/17) as posted before, you need to pass this parameter on a per-user basis. This requires changing it in your server side code if it is a custom implementation.