Troubleshooting the "client_requires_mfa_native_sso" Error in Native SSO Authentication
Last Updated:
Okta Identity Engine
API Access Management
Overview
When using the Native SSO flow, users may encounter the error message:
client_requires_mfa_native_sso.
This article helps in understanding what this error means, why it might happen, and how to fix it.
Applies To
- Okta Identity Engine (OIE)
- Native SSO Flow
Cause
The IDX cookie, set during the authorize call made to the first application, must be included in the request when performing the token exchange for the second native app. If the IDX cookie is not present, a client_requires_mfa_native_sso error will occur.
Solution
To fix this issue, there are a couple of possible solutions:
- Include the IDX cookie, obtained during the authorize request, in the token exchange request to ensure a successful response.
- To modify this behavior and remove the IDX cookie requirement, please contact the Okta support team for further assistance.
