Hi Salesforce Identity Community! I could really use some help/guidance getting through the last stretch of setting up a community SSO configuration.

We're aiming to use the SSO JIT provisioning to create community users. We're using our own Single Sign-On provider that is an OpenID 1.1 and OpenID Connect compliant identity provider.

Our SSO setup appears to be correctly configured, and we are able to create JIT community users, as expected. However, the issue is that those users are unable to login after the initial account provisioning; subsequent login attempts yield an “INVALID_ACCOUNT_ID” (code 18) error. The users show up in our users table, have the correct emails and federation ids, and by all appearances are valid users. The SAML validator reports no errors, and the Login History log reports "Failed: SAML Provision Error“ for the subsequent login attempts. There is no meaningful (i.e. not timestamp, state, nonce related) difference between the initial, successful account-creating SAML submission, and the subsequent, failing SAML submission.

Can you guys shed some light on how we can fix this? Thank you in advance for any assistance here!