SSO does not let you in

Symptom

You type your corporate email, click Continuar (Continue), and see one of these messages:

"Ese dominio no tiene inicio de sesión único configurado. Usa un enlace de acceso o tu contraseña." (That domain does not have single sign-on configured. Use an access link or your password.)
"No pudimos conectar con el proveedor de identidad de tu organización. Contacta a tu administrador." (We could not connect to your organization's identity provider. Contact your administrator.)
"No pudimos completar el inicio de sesión con tu proveedor. Intenta de nuevo." (We could not complete the sign-in with your provider. Try again.)
"No pudimos crear tu cuenta. Contacta a tu administrador para recibir una invitación." (We could not create your account. Contact your administrator to receive an invitation.)

Each message points to a different stage:

Message	Stage that failed
"Ese dominio no tiene inicio de sesión único configurado"	Your email domain is not in the Dominio de correo (Email domain) list of the Client's SSO provider (or you typed the email with a different domain).
"No pudimos conectar con el proveedor de identidad"	Studio could not reach the provider: network, expired certificate, or outdated metadata.
"No pudimos completar el inicio de sesión con tu proveedor"	The provider responded, but the response could not be validated: empty email attribute, or a signature or certificate different from the registered one.
"No pudimos crear tu cuenta"	You signed in correctly, but the Client does not allow creating accounts on the fly and you do not have an invitation.

Check the domain of the email you typed against the one your organization uses.
Click Usar enlace de acceso (Use access link) and try with the same email: if the link works, your account exists and the problem is only with SSO.
An administrator can see in Administración > Configuración > SSO (Administration > Settings > SSO) whether the provider is Activo (Active), how many days the certificate has left, and which domains it has (SSO).

Domain not configured: ask the administrator to add your domain to the provider, or sign in with an access link in the meantime.
Could not connect or complete: the administrator edits the provider and pastes the Metadata XML nuevo (New metadata XML) if the certificate changed; if the identity provider is down, wait and try again.
Account not created: ask for an invitation from Accesos (Access) (Members and roles); with SSO active, the invitation sets your role before your first sign-in.