Splunk Observability Cloud Login Failure – Duplicate User Identity Conflict for SAML User

Applicability

Description

A user with email xxxxxx@xxx.com experiences login failure to Splunk Observability Cloud with the error message:
"Email xxxxxx@xxx.com is already in use. Enter another email for verification."
The user can successfully access Splunk Cloud but not the Observability Cloud. Investigation revealed duplicate user records exist for the same email address: one SAML-based user and one non-SAML user. Attempts to delete the non-SAML user and resend invitations did not resolve the issue. The error persists during the verification workflow, indicating a backend identity conflict preventing successful onboarding.

Investigation

1. Confirm the user receives the "Email already in use" error during login to Splunk Observability Cloud.
2. Verify the user can authenticate successfully to Splunk Cloud, confirming SSO functionality.
3. Identify duplicate user records for the same email address in the Observability Cloud (SAML and non-SAML).
4. Delete the non-SAML user record.
5. Resend the invitation to the SAML-based user account.
6. Confirm if the issue persists after the user clears browser cache and cookies and attempts login via the SIGN IN SPLUNK CLOUD option with Unified Identity enabled.

Resolution

1. Remove the impacted user from Splunk Observability Cloud to eliminate duplicate or stale identity mappings.
2. Instruct the user to clear browser cache and cookies to remove any cached login states.
3. Advise the user to log in using the SIGN IN SPLUNK CLOUD option, leveraging Unified Identity (UID) for seamless SAML authentication.
4. Ensure no pre-existing user entry exists for the email address in Observability Cloud before the user's initial login.
5. Use a unique, unregistered email address when inviting or creating new users to avoid conflicts.
6. Verify the Organization ID matches the expected value before proceeding with user onboarding.
7. Confirm successful login and access to Splunk Observability Cloud after these steps.

Related Links

Unified Identity Setup for Splunk Observability Cloud