Skip to main content

SSO Troubleshooting - Okta

Updated

This article contains several helpful solutions in the event that an issue arose while configure your SSO integration to Okta. Before beginning troubleshooting it can be helpful for you to have:

  • The following values from the cnfg.OidcSettings table in your StockIQ database
    • Authority
    • Issuer
    • ClientID
  • The following values from the cnfg.InstanceConfiguration table in your StockIQ database
    • Instance URL
  • Admin level permissions in your Okta dashboard

The 'redirect_uri' parameter must be a Login redirect URI in the client app settings

  • This occurs when the Instance URL from the cnfg.InstanceConfiguration table does not match a value in your Okta app integration's Sign-in redirect URIs. 
  • To fix this:
    • Login to your Okta admin dashboard
    • Navigate to Applications > Applications and select the corresponding app integration for StockIQ
    • In the General tab under General Settings, click edit
    • In the Login section, review the Sign-in redirect URI's and ensure that you have a redirect URI that matches your Instance URL.
  • NOTE: The Instance URL in your StockIQ database should match your instance root, for example https://{YOUR-ORG}.stockiqtech.net/ OR https://{YOUR-ORG}.stockiqtech.net:{PORT}/
    • If your Instance URL in your StockIQ database does not match what you expect, please contact StockIQ Support
  • NOTE: The Sign-in redirect URIs in Okta are case sensitive 
  • NOTE: The expected Sign-in redirect URI should be https://{YOUR-ORG}.stockiqtech.net/Account/Login
    • It is important to note that both Account and Login are capitalized

Error: User is not assigned to the client application

  • The user attempting to authenticate against the StockIQ app integration does not have a valid assignment to the app integration.
  • Either the user needs to be added to a valid user group or the user needs to be directly assigned to the app integration.
  • To review app integration assignments:
    • Login to your Okta admin dashboard
    • Navigate to Applications > Applications and select the corresponding app integration for StockIQ
    • Click on the Assignments tab
    • Review both the 'People' and 'Group' sections to determine which groups and users are assigned to the StockIQ app integration
    • Ensure that the user is correctly assigned to the app registration, either directly as a user or as part of a group

Error: The response type is not supported by the authorization server.

  • This is the response that is received when the StockIQ app integration is not configured to respond with both an Authorization Code and an ID Token
  • StockIQ uses a hybrid authorization flow to more securely and immediately authenticate users, the StockIQ app integration in Okta needs to be configured to return these two request types
  • To fix this:
    • Login to your Okta admin dashboard
    • Navigate to Applications > Applications and select the corresponding app integration for StockIQ
    • Click on the General tab
    • In the application settings under Grant type, ensure that both Authorization Code and Implicit (hybrid) and its child Allow ID Token with implicit grant type are selected
      • NOTE: the 

Related articles