Okta Access Policy Rules with "AND User is" Filter Do Not Apply to API Service Apps/Client Credentials Flow
Last Updated:
Overview
This article explains that Okta's Access Policy rules, which use the AND User is filter set to Assigned the app and a member of one of the following, do not apply to the Client Credentials grant type (used by API Service Apps), because this flow operates without a user context.
Applies To
- Custom Authorization Servers
- Access Policies
- API Service Apps
- Client Credentials Flow
Cause
Okta Access Policy rules with an AND User is filter set to Assigned the app and a member of one of the following are not triggered during Client Credentials Flow. This flow is designed for machine-to-machine communication and, therefore, operates without an end-user context. Since there is no user associated with the request, any Access Rule that requires a specific user will not be met and, consequently, will not be applied.
Solution
To ensure the Access Policy rule is evaluated, set the AND User is filter to Any user assigned the app.
