Salesforce provisioning flow fails with the following error visible in the Okta dashboard:

Error message: Automatic provisioning of user to app Salesforce.com failed: com.sun.jersey.api.client.ClientHandlerException: Authorization failed, unable to refresh Access Token for salesforce
 

• Salesforce
• Provisioning
• Error

In Salesforce, the Refresh Token Policy is not set to Refresh token is valid until revoked for the connected OAuth app.
 

1. In Salesforce, navigate to the connected OAuth app. Click the Manage button on the page where the Consumer Key and Consumer Secret are located. Verify that the Refresh Token Policy is set to Refresh token is valid until revoked.
2. If it is not set, click the Edit Policies button and set it to Refresh token is valid until revoked.

Also, verify that these OAuth scopes are selected for the Connected OAuth App:

3. After making the changes, go to the Okta admin panel and navigate to Applications > Salesforce > Provisioning > Integration > Edit.
4. Click Re-authenticate with Salesforce.com.
5. In the new Salesforce.com window, enter the administrator username and password used to create the Connected OAuth App.
6. Click Allow to permit access to the Connected App.
7. Click Save.
8. Attempt the failed Okta task again.

Related References

• Configure OAuth and REST integration