Okta Default Custom Auth Server No Longer Includes a Default API Access Policy - Error "FAILURE: no_matching_policy"
Last Updated:
Overview
An Okta error occurs when attempting to sign in using sample applications or Quickstart guides because newly provisioned organizations no longer include a pre-set access policy on the Default Custom Authorization Server. Resolve this by adding a new API access policy to the Default Custom Authorization Server or updating the issuer Uniform Resource Identifier (URI) to point to the organization's authorization server. Users experience access issues and see the following error when attempting to sign in, with a corresponding error appearing in the system log:
You are not allowed to access this app. To request access, contact an admin.
OAuth2 authorization request FAILURE: no_matching_policy
Applies To
- Okta Identity Engine (OIE)
- Okta Classic Engine
- API Access Management
- Default Custom Authorization Server
- OAuth 2.0
Cause
As of the 2024.08.0 release, Okta no longer provisions newly created organizations, including those available from the developer.okta.com sign-up page, with a pre-set access policy on the default custom authorization server.
Solution
The Application Requires a Specific Authorization Server Configuration
Determine which authorization server the application requires and apply the appropriate configuration.
What steps configure the default custom authorization server?
Add a new API access policy to the default custom authorization server and verify the policy rules.
- Navigate to the default custom authorization server in the Admin Console.
- Add a new API access policy.
- Check the policy rules to verify that they apply correctly to the specific use case.
What steps configure the organization authorization server?
Update the issuer URI in the sample SDK or Quickstart guide to point to the organization authorization server.
- Locate the issuer reference in the sample SDK or Quickstart guide.
- Update the issuer URI to point to the organization authorization server by replacing the
https://<OktaDomain>/oauth2/defaultstring with the organization value.issuer: 'https://<OktaDomain>/'
NOTE: The following article indicates which use cases/functionality are supported by each Authorization Server type: When to Use the Org Authorization Server vs a Custom Authorization Server in Okta | Okta Support Center.
