External IDP (OIDC) in Okta -

Questions OAuth/OIDC
1

I followed the Enterprise Identity Provider | Okta Developer

When I go to test the configuration I am getting a “Bad Request” 400 error with this url “https://savemart.oktapreview.com/oauth2/v1/authorize?idp=0oab5vwfc9wZI5JaO1d7”

If I select the “Go to Homepage” option the next url is “https://savemart.oktapreview.com/sso/idps/0oab5vwfc9wZI5JaO1d7?stateTokenExternalId=aHcwSFFHZzNvYmpMRGthMjVtZ2VYV3ZWdVBjbGpmOERJREQrTldocnRJWVdqT2V4V01vMmt3TG44bDltcjI0Wg” with another “Bad Request” error

I do not see any entries in the system log for this attempt.

I have pasted the 2 Oauth Tracer logs below for these 2 attempts:

<client_id>okta.2b1959c8-bcc0-56eb-a589-cfcfb7422f26</client_id>
<code_challenge>gir9rcK44FsPgY2cNX1lLozY4Y2AsMGoDZCnk6cyCrU</code_challenge>
<code_challenge_method>S256</code_challenge_method>
kGDRADuzegWIRCHo78pfwqCYwQVKCpY0y4XTKxzdbjBnvpQyjXXnn9XUrqxzeh1C
<redirect_uri>https://savemart.oktapreview.com/enduser/callback</redirect_uri>
<response_type>code</response_type>
NT8cEHQNVEhT10JhWBX98p684M194HCOVQtvkybQo4FPwlheRv6hxQxRnIbcTTPu
openid profile email okta.users.read.self okta.users.manage.self okta.internal.enduser.read okta.internal.enduser.manage okta.enduser.dashboard.read okta.enduser.dashboard.manage

<client_id>okta.2b1959c8-bcc0-56eb-a589-cfcfb7422f26</client_id>
<code_challenge>EN0A3BMkZNx9DHRF1ToEOFmtpIiE7Yd6PUp-o7f_u7s</code_challenge>
<code_challenge_method>S256</code_challenge_method>
W4DgExXzUtGCdcfFbbHEyGgzKZYoE1tfvQWTNhpiWpwMGYt4XDoijbpqAkW1vC1X
<redirect_uri>https://savemart.oktapreview.com/enduser/callback</redirect_uri>
<response_type>code</response_type>
99Z0NtRcC7a6ojpA5ntu2ILQnk7KKbBhCvHuqjHN1jGICxL6Qhi4EUMqSJQPOUNA
openid profile email okta.users.read.self okta.users.manage.self okta.internal.enduser.read okta.internal.enduser.manage okta.enduser.dashboard.read okta.enduser.dashboard.manage

2

Hello,

For OIE Okta Orgs social IdPs are now configured entirely via backend policies, even if you want to have social buttons show up on the sign-in widget.
There are a few ways you can have a user redirected to an external IdP

  • IdP discovery rules (configured in IdP routing rules)
  • Display Social Buttons and let a user select (also configured in IdP routing rules)
  • If doing an authorization code flow include the idp parameter in the request.

What is correct for your situation depends.
I suggest opening a support case so more information can be gathered for you Okta setup.

Thank You,

1 Like