{"templateId":"markdown","sharedDataIds":{"sidebar":"sidebar-sidebars.yaml"},"props":{"metadata":{"markdoc":{"tagList":[]},"type":"markdown"},"seo":{"title":"Okta SSO troubleshooting","llmstxt":{"hide":false,"sections":[{"title":"Table of contents","includeFiles":["**/*"],"excludeFiles":[]}],"excludeFiles":[]}},"dynamicMarkdocComponents":[],"compilationErrors":[],"ast":{"$$mdtype":"Tag","name":"article","attributes":{},"children":[{"$$mdtype":"Tag","name":"Heading","attributes":{"level":1,"id":"okta-sso-troubleshooting","__idx":0},"children":["Okta SSO troubleshooting"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Use this page to troubleshoot common Okta SSO setup and sign-in issues."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"okta-rejects-sign-in","__idx":1},"children":["Okta rejects sign-in"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Check:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["the sign-in redirect URI matches exactly."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["the URI includes the trailing slash."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["no dev, staging, localhost, preview, or internal test URL is configured as a"," ","redirect URI."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["the user is assigned to the Mabyduck app in Okta."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["the issuer URL sent to Mabyduck matches the Okta app."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["the client ID and client secret sent to Mabyduck match the Okta app."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"okta-asks-for-a-post-logout-uri","__idx":2},"children":["Okta asks for a Post Logout URI"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Leave the Post Logout URI empty. Mabyduck does not support OIDC Single Logout."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["If you want Okta to end active Mabyduck sessions, configure Universal Logout"," ","with the global token revocation endpoint instead."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"password-google-or-github-sign-in-does-not-work","__idx":3},"children":["Password, Google, or GitHub sign-in does not work"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["This is expected for users in an Okta-enabled organization."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Okta is the required sign-in method. Tell the user to start from the Okta tile"," ","or the organization login page at ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["https://app.mabyduck.com/org/{org-slug}/"]},"."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"user-signs-in-but-does-not-reach-mabyduck","__idx":4},"children":["User signs in but does not reach Mabyduck"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Check:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Okta provides the user's email address."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["the user is assigned to the same Okta app that Mabyduck has connected."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["the user does not already belong to another Mabyduck organization."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"universal-logout-does-not-end-a-session","__idx":5},"children":["Universal Logout does not end a session"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Check:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Okta is sending requests to the Mabyduck revocation endpoint."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["the endpoint URL includes the trailing slash."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["the Universal Logout authentication method is ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["SIGNED_JWT"]},"."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["the subject format is ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Issuer and Subject identifier"]},"."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"contact-support","__idx":6},"children":["Contact support"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Include:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Okta issuer URL."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Mabyduck organization slug."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["affected user email address."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["exact error message."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["whether the issue happens from the Okta tile, the Mabyduck login page, or"," ","both."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"related-pages","__idx":7},"children":["Related pages"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/account-and-settings/iam/okta"},"children":["Configure Okta SSO"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/account-and-settings/iam"},"children":["Identity and access management"]}]}]}]},"headings":[{"value":"Okta SSO troubleshooting","id":"okta-sso-troubleshooting","depth":1},{"value":"Okta rejects sign-in","id":"okta-rejects-sign-in","depth":2},{"value":"Okta asks for a Post Logout URI","id":"okta-asks-for-a-post-logout-uri","depth":2},{"value":"Password, Google, or GitHub sign-in does not work","id":"password-google-or-github-sign-in-does-not-work","depth":2},{"value":"User signs in but does not reach Mabyduck","id":"user-signs-in-but-does-not-reach-mabyduck","depth":2},{"value":"Universal Logout does not end a session","id":"universal-logout-does-not-end-a-session","depth":2},{"value":"Contact support","id":"contact-support","depth":2},{"value":"Related pages","id":"related-pages","depth":2}],"frontmatter":{"seo":{"title":"Okta SSO troubleshooting"}},"lastModified":"2026-05-22T20:24:18.000Z","pagePropGetterError":{"message":"","name":""}},"slug":"/account-and-settings/iam/sso-troubleshooting","userData":{"isAuthenticated":false,"teams":["anonymous"]},"isPublic":true}