> ## Documentation Index
> Fetch the complete documentation index at: https://docs.invoca.com/llms.txt
> Use this file to discover all available pages before exploring further.

# 403 Error Logging Into Invoca via SAML/SSO: Required Attributes

> This 403 error occurs when your identity provider isn't sending a required user attribute — usually `contact_phone_number` — in the SAML response.

**Applies to:** SAML SSO integration, customers implementing Invoca's [SAML SSO Setup](/s/article/jhdcp92865-570)

## Symptoms

* A user sees a 403 error when attempting to log in to Invoca via SAML/SSO.
* The SAML response includes an error message reading "Contact phone number can't be blank, Contact phone number Invalid." You'll need your SSO debugger to see this message.
* This is often the user's first login attempt via SAML/SSO.

## Cause

The user's configuration in your identity provider (IdP) is missing the required attribute `contact_phone_number`.

## Resolution

1. In your identity provider, open the user attributes in your user configuration.
2. Confirm the configuration includes:
   * `first_name`
   * `last_name`
   * `contact_phone_number`
   * `organization_id_from_network` — required only if you're using the optional `organization_type` attribute and its value is "Advertiser" or "Affiliate"
3. Add any missing attributes to the identity provider's user configuration.

See the Attribute Mappings Reference in [SAML SSO Setup](/s/article/jhdcp92865-570) for the full list of attributes Invoca requires or accepts.

## Where to go next

<CardGroup>
  <Card title="SAML SSO Setup" icon="key" href="/s/article/jhdcp92865-570" horizontal />

  <Card title="Configure SSO with Okta" icon="lock" href="/s/article/configure-sso-with-okta" horizontal />

  <Card title="403 Error Logging Into Invoca via SAML/SSO: Invalid Signature" icon="triangle-exclamation" href="/s/article/403-error-saml-sso-invalid-signature" horizontal />
</CardGroup>