class Users::InvitationsController < Devise::InvitationsController
   private
   def resource_params
     params.permit(user: [:email, :invitation_token, :role, :company_id])[:user]
   end
end

class InvitationsController < Devise::InvitationsController
  before_action :update_sanitized_params, only: :update

  # PUT /resource/invitation
  def update
    respond_to do |format|
      format.js do
        invitation_token = Devise.token_generator.digest(resource_class, :invitation_token, update_resource_params[:invitation_token])
        self.resource = resource_class.where(invitation_token: invitation_token).first
        resource.skip_password = true
        resource.update_attributes update_resource_params.except(:invitation_token)
      end
      format.html do
        super
      end
    end
  end


  protected

  def update_sanitized_params
    devise_parameter_sanitizer.permit(:accept_invitation, keys: [:password, :password_confirmation, :invitation_token, profile_attributes: [:first_name, :last_name]])
  end
end

<%= f.fields_for :profile do |p| %>
    <div class="form-group">
      <%= p.label :first_name, class: 'sr-only' %>
      <%= p.text_field :first_name, autofocus: true, class: 'form-control', placeholder: 'First name' %>
    </div>

    <div class="form-group">
      <%= p.label :last_name, class: 'sr-only' %>
      <%= p.text_field :last_name, class: 'form-control', placeholder: 'Last name' %>
    </div>
  <% end %>

...
accepts_nested_attributes_for :profile, reject_if: proc { |attributes| attributes[:first_name].blank? }