Single sign-on error codes (mpbx-oidc, mpbx-auth::sso)

Raised by the OIDC sign-in routes under /api/v1/auth/oidc and the provider settings under /api/v1/sso/providers (W7-INT-02a). Messages never contain a token, an authorization code, a client secret or an e-mail address. Guide: Single sign-on.

Code	HTTP	Meaning	What to do
MPBX-SSO-PROVIDER-UNKNOWN	404	The provider is not one of the enabled sign-in providers of the company this web address belongs to.	Use a provider from GET /auth/oidc/providers of the same address.
MPBX-SSO-REDIRECT-NOT-ALLOWED	400	The redirect_uri is not on the provider's allow-list. The comparison is exact (scheme, host, port, path, query); there are no wildcards or prefixes.	Add the exact address to the provider's redirect_uris, or send one that is listed.
MPBX-SSO-STATE-INVALID	401	The sign-in attempt is unknown, expired (10 minutes), already used, of another company, or was started in another browser (the browser binding cookie is missing or does not match). Nothing was exchanged with the provider.	Start the sign-in again from the sign-in page.
MPBX-SSO-PROVIDER-UNAVAILABLE	503	The provider's discovery document, key set or token endpoint could not be reached, was refused by the outbound guard (only public https addresses), named another issuer, or answered something unusable.	Retry later; an administrator checks the issuer.
MPBX-SSO-EXCHANGE-FAILED	401	The provider refused the authorization code (expired, already used, wrong client credentials, PKCE verifier or redirect URI).	Start the sign-in again; an administrator checks the client id and secret.
MPBX-SSO-TOKEN-INVALID	401	The ID token failed validation: not an asymmetric signature by a key of the provider's key set, wrong issuer, audience or authorized party, expired or not yet valid, or the nonce does not match.	Start the sign-in again; if it persists, check the server clock and the provider's keys.
MPBX-SSO-EMAIL-UNVERIFIED	403	The provider did not assert a verified e-mail address (email_verified; for Microsoft Entra ID the optional claim xms_edov).	Verify the address at the provider; for Entra ID add the email and xms_edov optional claims to the app registration.
MPBX-SSO-DOMAIN-NOT-ALLOWED	403	The verified e-mail address is outside the domains the company allows for this provider.	Sign in with an account of an allowed domain, or an administrator adds the domain.
MPBX-SSO-NO-ACCOUNT	403	No active account of this company has this e-mail address (single sign-on links existing accounts only; it never creates one), the linked account is disabled, or the account holds a system role (those sign in with their local password and authenticator, the break-glass path).	An administrator creates or enables the account; system accounts use the e-mail and password form.
MPBX-SSO-DISCOVERY-FAILED	400	Saving a provider: the issuer's discovery document could not be read through the outbound guard or does not name exactly this issuer.	Check the issuer URL (for Microsoft the directory id, a GUID) and that it is a public https address.
MPBX-SSO-TOO-MANY	409	The company already has 10 sign-in providers.	Remove one first.
MPBX-SSO-NOT-FOUND	404	No sign-in provider with this id in this company (another company's provider is invisible).	Check the id.