The user is locked in Penelope -- they will need to be unlocked before they can proceed.

The user's GUID as listed in Penelope does not match their GUID in their SSO side settings. This can be confirmed by logging in as a System Admin, navigating to the Security page, selecting the Maintenance tab and downloading the User Authentication Status file.

There is more than one user in Penelope with the same GUID. This can also be confirmed by reviewing the User Authentication Status file.