# Web sign in failed because no\_matching\_policy

**URL:** <https://devforum.okta.com/t/web-sign-in-failed-because-no-matching-policy/31489>\
**Category:** OAuth/OIDC\
**Created:** [December 16, 2024, 12:27pm UTC](https://devforum.okta.com/t/web-sign-in-failed-because-no-matching-policy/31489 "2024-12-16T12:27:47Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![ccmhwy](https://avatars.discourse-cdn.com/v4/letter/c/7ba0ec/32.png) [@ccmhwy](https://devforum.okta.com/u/ccmhwy)\
**Post date:** [December 16, 2024, 12:27pm UTC](https://devforum.okta.com/t/web-sign-in-failed-because-no-matching-policy/31489/1 "2024-12-16T12:27:47Z")

</div>

1. I created an okta application for test
2. Add person and assign to application
3. Run WebSignIn sample in okta-mobile-swift sdk
4. Input correct issuer and clientId and redirect uri in okta.plist
5. click sign in
6. input user name and password, got “You are not allowed to access …”
7. check system log in developer system, and got log:  
 ![image](https://global.discourse-cdn.com/oktadev/original/2X/1/17d5dc9e3db290ac673f9bf93c2cf64139c2f143.jpeg)
8. my okta appliaction config:  
Grant type : Client Credentials, Authorization Code, Refresh Token, Interaction Code  
And all rules are passed  
And the access testing tool shows that the user can access the application

so which step I was wrong???

---

<div class="post-metadata">

**Author:** ![ramgan](https://avatars.discourse-cdn.com/v4/letter/r/ba9def/32.png) [@ramgan](https://devforum.okta.com/u/ramgan)\
**Post date:** [December 16, 2024, 7:46pm UTC](https://devforum.okta.com/t/web-sign-in-failed-because-no-matching-policy/31489/2 "2024-12-16T19:46:52Z")

</div>

You could check for the type of authorization server you are using, this failure might mean you might be using Custom authorization server. Confirm this first.

> **[Authorization servers | Okta Developer](https://developer.okta.com/docs/concepts/auth-servers/#available-authorization-server-types)**
>
> An overview of what an authorization server is and the types of authorization servers available at Okta.

If you are using custom authorization server, check whether you have an access policy rule which allows this test login. For example, check if the app, user, scope combinations allow access.

> **[Configure an access policy | Okta Developer](https://developer.okta.com/docs/guides/configure-access-policy/main/)**
>
> Okta access policies help you secure your APIs by defining different access and refresh token lifetimes for a given combination of grant type, user, and scope.

---

<div class="post-metadata">

**Author:** ![ccmhwy](https://avatars.discourse-cdn.com/v4/letter/c/7ba0ec/32.png) [@ccmhwy](https://devforum.okta.com/u/ccmhwy)\
**Post date:** [December 17, 2024, 1:52am UTC](https://devforum.okta.com/t/web-sign-in-failed-because-no-matching-policy/31489/3 "2024-12-17T01:52:12Z")

</div>

wow, u are right!  
Using default auth server, but no access poilcies!

 ![image](https://global.discourse-cdn.com/oktadev/original/2X/2/28095801cb08a0dc18669eb232c647a4d5264f64.jpeg)

I added a rule and solved my issues!

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/oktadev/original/1X/589c4c5f80de422d01f47cee7185a7fb8227835c.png) [@system](https://devforum.okta.com/u/system)\
**Post date:** [December 18, 2024, 1:53am UTC](https://devforum.okta.com/t/web-sign-in-failed-because-no-matching-policy/31489/4 "2024-12-18T01:53:02Z")

</div>

This topic was automatically closed 24 hours after the last reply. New replies are no longer allowed.