SSO Login of an inactive user throws Page not Found

Problem

When trying to login to the repo via Shib an initiative user is redirected to "Page not found: The page you are looking for could not be found.".

When logging in without previous SSO login the IDP rejects the login.

If SSO was previously used the IDP doesn't catch the missing rights that should be done on the invenio side of things.

Page not found is not a proper handling and can be confused with a system error

user lifecycle

https://www.uni-bamberg.de/its/dienstleistungen/iam/nutzerkonto/user-lifecycle/

Bedienstete – wissenschaftlich* will be set to inactive the day after their contract ends. Initiative users are filtered.