Customize Okta "Invalid value for 'client_id' parameter" Error That Occurs During Org2Org SAML Authentication for Unknown Users
Last Updated:
Overview
An error occurs during inbound Organization-to-Organization (Org2Org) Security Assertion Markup Language (SAML) Identity Provider (IdP) authentication when the receiving tenant lacks a matching user profile. This happens because Okta drops the original application context when failing to match the incoming user to an existing profile. Okta does not support redirecting this specific error to a custom page. End users experience the following error screen:
Invalid value for 'client_id' parameter
The System Log records the following errors despite successful transformation of the Employee Identification (EMPLID) attribute:
User Not Found
Unable to match transformed username
core.user_auth.idp.no_matching_users
Applies To
- Okta Identity Engine (OIE)
- Okta Classic Engine
- Organization-to-Organization (Org2Org)
- Security Assertion Markup Language (SAML) Identity Provider (IdP)
Cause
The error message appears because Okta drops the original application context, including the client_id of the requested application, when the IdP fails to match the incoming user to an existing Okta profile. Okta attempts to redirect the user to the default sign-in page without this context, which generates the generic client_id validation error instead of a user not found message.
Solution
Can Okta redirect the client ID validation error to a custom page?
Okta does not support redirecting this error to a custom page directly through the Identity Provider settings. Okta allows administrators to configure a Custom Error Page under Security > Identity Providers > [IdP Settings]. However, this setting does not apply to sign-in failures caused by an unknown user or a Just-In-Time (JIT) provisioning failure.
In these scenarios, Okta bypasses the IdP custom error URL and attempts to redirect the user to the default Okta sign-in page, which leads to the lost client_id error.
Review the Specify an error page for Identity Provider, SAML, or SSO documentation for more information.
