> For the complete documentation index, see [llms.txt](https://platform9.com/kb/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://platform9.com/kb/pcd/identity/unable-to-reconfigure-sso-in-pcd-ui-using-the-same-entity-id.md).

# Unable to Reconfigure SSO in PCD UI Using the Same Entity ID

## Problem

After disabling SSO in the Platform9 PCD UI, attempting to reconfigure SSO with the same entity ID is not allowed. The UI displays an error "*Identity provider already exists*" or does not permit using the previous entity ID for SSO setup.

## Environment

* Private Cloud Director Virtualization - till 2025.7-47
* Private Cloud Director Kubernetes – till 2025.7-47
* Self-Hosted Private Cloud Director Virtualization - till 2025.7-47
* Self-Hosted Private Cloud Director Kubernetes - till 2025.7-47
* Component - SSO

## Cause

Disabling SSO from the PCD UI removes the SSO settings from the backend service (Consul) but does not delete the Identity Provider (IDP) object from OpenStack. This means the entity ID stays in OpenStack, stopping reuse during reconfiguration. 

This was a known issue which is tracked under **PCD-3227** and is now fixed starting with the August release **(v2025.8-92) and higher.**

## Diagnostics

To allow SSO to be reconfigured with the same entity ID

**Step 1:** List existing identity provider:

<pre class="language-bash"><code class="lang-bash">$ openstack identity provider list

+---------------------+---------------------------------------------------------------+
| Field               | Value                                                         |
+---------------------+---------------------------------------------------------------+
| authorization_ttl   | None                                                          |
| description         | None                                                          |
| domain_id           | default                                                       |
| enabled             | True                                                          |
<strong>| id                  | [IDP1_VALUE]                                                  |
</strong>| remote_ids          | https://[URL]                                                 |
+---------------------+---------------------------------------------------------------+
</code></pre>

**Step 2:** Verify Existing IDP Configuration:

Use the following commands to check the current IDP state (replace **\<IDP1\_VALUE>** with the actual identity provider name):

```bash
$ openstack mapping list
$ openstack identity provider show <IDP1_VALUE> --fit-width
$ openstack federation protocol list --identity-provider <IDP1_VALUE>
$ openstack federation protocol show saml2 --identity-provider <IDP1_VALUE>
$ openstack group list
$ openstack group show <GROUP_ID>
```

Run these commands to review and confirm the existing identity provider (IDP) configuration including its details, associated federation protocols, mappings, and any related OpenStack groups.&#x20;

The above step is to ensure that you are deleting the correct identity provider and do not accidentally remove configurations that may be used by other SSO integrations, mappings, or user groups. Proceed with deletion only if you are certain that the information shown matches the identity provider you intend to remove.

## Workaround

Delete the stale identity provider using the below Openstack command:

```bash
$ openstack identity provider delete <IDP1_VALUE>
```

## Validation

After deleting the identity provider, refresh the PCD UI and reconfigure SSO with the desired entity ID.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://platform9.com/kb/pcd/identity/unable-to-reconfigure-sso-in-pcd-ui-using-the-same-entity-id.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.