I was having this issue as well. The problem was that the user’s WordPress role wasn’t getting assigned. In my case, it was because the IdP (Okta) wasn’t mapping the “groups” attribute correctly.
On the plugin’s Service Provider tab, I had to change the “Attribute to be used as Groups” field from “group” to “groups”.