A misconfiguration in the Salesforce connected application or incorrect OAuth credentials causes an administrator credential verification error in Okta. Generate new OAuth credentials and correct the Salesforce connected application settings to resolve the error. When re-authenticating the OAuth Consumer Key and OAuth Consumer Secret in the Provisioning tab of the Salesforce integration, Okta generates a credential verification error stating that the Salesforce administrator credentials require confirmation.

Could not verify the Salesforce administrator credentials, please confirm that these are set correctly.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Salesforce
• Provisioning
• OAuth Consumer Key
• OAuth Consumer Secret

This error occurs due to one or more of the following conditions:

• The OAuth Consumer Key or OAuth Consumer Secret values contain typos or trailing spaces.
• The account that created the OAuth Consumer Key or OAuth Consumer Secret either lacks the required Salesforce System Admin permissions or is inactive.
• The OAuth application created in Salesforce contains an incorrect configuration.
• The Salesforce external client application or legacy Salesforce connected application contains a misconfigured callback URL. The correct callback URL is https://system-admin.okta.com/admin/app/generic/oauth20redirect.
• The Salesforce configuration lacks the enabled Require Proof Key for Code Exchange (PKCE) Extension for Supported Authorization Flows setting.
• The Salesforce external client application or legacy Salesforce connected application configuration lacks the enabled Require Secret for Web Server Flow setting.
• The Salesforce external client application or legacy Salesforce connected application configuration lacks the enabled Require Secret for Refresh Token Flow setting.
• The Salesforce external client application or legacy Salesforce connected application configuration lacks the All users who may self-authorize option selection.
• The Salesforce external client application or legacy Salesforce connected application configuration lacks the Manage user data via APIs (api) and Perform requests at any time (refresh_token, offline_access) OAuth scopes.
• The specific Salesforce edition requires an API feature purchase.
• The Single Sign-On (SSO) portion of the integration contains an incorrect configuration.
• The Salesforce Session Settings contain an enabled Lock sessions to the IP address from which they originated option, which restricts the session IP address.

How is the Salesforce administrator credential verification error resolved?

Verify the Salesforce application configuration, generate new OAuth credentials, and re-authenticate the integration in the Okta Admin Console.

1. Verify the Salesforce Representational State Transfer (REST) or OAuth legacy connected app or external client application for the Okta Salesforce provisioning integration contains the correct configuration by following the Configure OAuth and REST integration documentation.
2. Generate new OAuth Consumer Key and OAuth Consumer Secret values in Salesforce.
   NOTE: The OAuth application created in Salesforce must use the proper Salesforce OAuth scopes and Profile type.
3. Open an incognito web browser tab and navigate to Okta Admin Console > Applications > Applications.
4. Select the Salesforce application and navigate to the Provisioning tab.
5. Select Integration and enter the newly generated Salesforce consumer key in the OAuth Consumer Key field.
   NOTE: Ensure the copied value does not contain trailing spaces.
6. Enter the newly generated Salesforce consumer secret in the OAuth Consumer Secret field.
   NOTE: Ensure the copied value does not contain trailing spaces.
7. Select the PKCE Enabled checkbox.
8. Click Authenticate with Salesforce or Re-authenticate with Salesforce.
9. Enter the Salesforce custom domain URL in the new Salesforce login window if configured in the external Salesforce application.
10. Log in with the same Salesforce System Admin account credentials used to create the Salesforce legacy connected OAuth or Salesforce external client application.
11. Verify that authentication succeeds, then click Save.

Related References

• Configure OAuth and REST integration
• Update Salesforce Provisioning Applications to Support PKCE