Error with Okta Workplace Enterprise Connection

[sai.samant]

We are configuring an enterprise connection for a customer using Okta. Have followed the directions here

Connect Your Auth0 Application with Okta Workforce Enterprise Connection

When we “Try” the connection, we see the customer’s Okta login page and we see that our own login page correctly goes to SSO-Enabled when we enter an email with the customer’s domain.

However, when the customer tries to login, they receive the following access denied error: “the resource owner or authorization server denied the request”

I have looked at the solution described here:

Error with Okta as Oauth2 Identity Provider (OIDC connection)

Problem statement I’m trying to log in with Okta OIDC from Universal Login (Auth0 as SP) with the Okta connection button, but it comes back with an error. Error in the test page: "the resource owner or authorization server denied the request" Callback with error: “Status 400” Steps to reproduce Follow the 6 steps here, and then either of the below steps: Try the connection button within the dashboard Login and click on the connection button Cause As explained in this article, Using th…

But when I examine the authorization endpoint in the auth0 connection metadata, it already appears to be in the correct format: "authorization_endpoint": "https://<customer_domain>.okta.com/oauth2/v1/authorize".

Are there any other reasons the customer could be seeing this error? We have double checked the client ID and secret values in the Auth0 Enterprise Connection. We also recently configured an Okta Workplace Enterprise Connection for another customer and did not encounter this issue.

[ale.vesga1]

Hi @sai.samant,

I’ve reviewed your connections, and they appear to be configured correctly. I was unable to reproduce the issue you’re experiencing.

Since this has worked successfully for another customer, I recommend deleting the connection and reconfiguring it to see if that resolves the problem.

It’s also possible that the issue could be related to a configuration on the Okta side. I suggest reaching out to Okta support to investigate further.

Hope this helps!