Summary: SAML authentication fails for users created within the last hour due to directory sync lag between the identity provider and FieldPulse.
Symptoms
- Newly provisioned users receive "Authentication failed" or "User not found" errors when attempting SSO login.
- The error occurs despite the user appearing in the FieldPulse admin user list.
- Users provisioned more than 60 minutes prior log in successfully via SSO.
- Manual password login works as a temporary bypass.
Affected Platforms
- All SAML 2.0 identity providers (Okta, Azure AD, OneLogin, Ping Identity)
- FieldPulse web application and mobile app
- Versions: 3.2.0 — present
Cause
A caching layer introduced in 3.2.0 to reduce directory query load is not invalidated when new user records are created via SCIM provisioning or manual admin invitation. The cache TTL is set to 60 minutes. As a result, authentication requests for users created within that window fail because the SAML assertion cannot be matched to a cached user record.
Resolution
No immediate configuration change is available. Two workarounds are documented below.
Workaround
- Wait period: Advise users to wait 60 minutes after provisioning before their first SSO login.
- Manual cache clear (admin only): Navigate to Settings > Security > SSO Configuration and click Clear Directory Cache. This forces immediate cache invalidation for the entire organization. Note: This action is logged in the audit trail.
- Temporary password login: Users can set a FieldPulse-native password via the password reset flow and log in directly while waiting for cache expiration.
Status
Under investigation. Engineering has identified the root cause. A fix targeting cache invalidation on SCIM POST /Users and PUT /Users events is scheduled for release 3.3.0. No patch release is planned for 3.2.x given the availability of workarounds.
Last updated: 2026-04-23
