Use this page to troubleshoot common Okta SSO setup and sign-in issues.
Check:
- the sign-in redirect URI matches exactly.
- the URI includes the trailing slash.
- no dev, staging, localhost, preview, or internal test URL is configured as a redirect URI.
- the user is assigned to the Mabyduck app in Okta.
- the issuer URL sent to Mabyduck matches the Okta app.
- the client ID and client secret sent to Mabyduck match the Okta app.
Leave the Post Logout URI empty. Mabyduck does not support OIDC Single Logout.
If you want Okta to end active Mabyduck sessions, configure Universal Logout with the global token revocation endpoint instead.
This is expected for users in an Okta-enabled organization.
Okta is the required sign-in method. Tell the user to start from the Okta tile or the organization login page at https://app.mabyduck.com/org/{org-slug}/.
Check:
- Okta provides the user's email address.
- the user is assigned to the same Okta app that Mabyduck has connected.
- the user does not already belong to another Mabyduck organization.
Check:
- Okta is sending requests to the Mabyduck revocation endpoint.
- the endpoint URL includes the trailing slash.
- the Universal Logout authentication method is
SIGNED_JWT. - the subject format is
Issuer and Subject identifier.
Include:
- Okta issuer URL.
- Mabyduck organization slug.
- affected user email address.
- exact error message.
- whether the issue happens from the Okta tile, the Mabyduck login page, or both.