Okta 401 Permissions Error During OIDC Application Login or Custom Authorization Server Configuration
Last Updated:
Overview
An Okta HTTP 401 error occurs during OpenID Connect (OIDC) application authorization or custom authorization server configuration because the Okta org lacks the paid API Access Management feature. Resolve this error by configuring the integration to use the built-in Org Authorization Server or by contacting an Okta Account Manager to add the required license. When requesting to authorize into an OIDC application or configure a custom authorization server, Okta generates the following error:
Okta HTTP 401 E0000015 You do not have permission to access the feature you are requesting.
Applies To
- Okta Identity Engine (OIE)
- Okta Classic Engine
- OpenID Connect (OIDC) / OAuth 2.0 Applications
- /oauth/{{authorizationServerId}}/v1/authorize
- /oauth2/{{authorizationServerId}}/v1/token
- /api/v1/authorizationServers
Cause
The Okta org lacks the paid API Access Management feature required to use a Custom Authorization Server.
Solution
How is the 401 permissions error resolved?
A Custom Authorization Server, such as the one named Default, requires the API Access Management license. Orgs without this license must use the built-in Org Authorization Server, which is not customizable.
The Built-in Org Authorization Server Has Specific Limitations
The built-in Org Authorization Server restricts administrators from configuring access policies, creating custom scopes, and completing local access token validation.
- Create a Token Inline Hook.
- Create custom scopes or claims.
- Complete local access token validation.
How is the built-in Org Authorization Server configured?
Configure the integration to reference the built-in Org Authorization Server by updating the authorization request endpoints and locating the discovery endpoint.
- Make the authorization request to the Org Authorization Server Authorization Endpoint.
- Locate the endpoints for the Org Authorization Server at the Org Authorization Server Discovery Endpoint.
NOTE: The Authorization Endpoint for the Default Custom Authorization Server is the Default Custom Authorization Server Endpoint.
Contact an Okta Account Manager to Enable Custom Authorization Servers
If the built-in Org Authorization Server does not meet the requirements of the use case, contact an Okta Account Manager to discuss adding the API Access Management license.
