Okta Inbound SAML Authentication Fails With "Unable to Validate User due to Invalid Status" Error
Last Updated:
Overview
An inbound Security Assertion Markup Language (SAML) authentication failure occurs when an administrator converts an inbound SAML or Org2Org user to an Okta-sourced user with a password. Resolve this issue by deleting and recreating the user account as an inbound SAML user, or by instructing the user to authenticate with a username and password. During inbound SAML authentication, Okta generates the following error:
Unable to Validate User due to Invalid Status
Applies To
- Okta Identity Engine (OIE)
- Okta Classic Engine
- Inbound Security Assertion Markup Language (SAML) Authentication
- Org2Org authentication
- Single Sign-On (SSO)
Cause
The error occurs because an administrator converts a user who originally used inbound SAML or Org2Org authentication into an Okta-sourced user with a password.
The user's status needs to be verified in Okta because the issue may vary depending on the user's status.
Solution
How is the invalid status error resolved?
Delete the existing user account and recreate it as an inbound SAML user to restore inbound authentication functionality.
- Delete the user account that triggers the error.
- Recreate the user as an inbound SAML user.
Authenticate Directly Into the Destination Organization
Instruct the user to bypass the inbound SAML flow and authenticate directly into the destination organization.
- Navigate to the destination organization login page.
- Enter the username and password to sign in.
