Okta Error idx.error.code.no_matching_policy Occurs During Embedded Authentication
Last Updated:
Overview
The idx.error.code.no_matching_policy error occurs during embedded authentication when the custom authorization server access policy lacks the Interaction Code grant type. Administrators resolve this issue by enabling the Interaction Code grant type in the access policy rule. Okta Identity Engine (OIE) exclusively supports the Interaction Code grant type; Okta Classic Engine does not support this feature. When this error occurs, Okta generates the following message:
You are not allowed to access this app. To request access, contact an admin.
Applies To
- Okta Identity Engine (OIE)
- OpenID Connect (OIDC)
- Okta Embedded Sign-in with SDK
- OpenID Connect / OAuth 2.0 application
- Custom Authorization Server
Cause
This error is thrown from the SDK when using embedded authentication and the Interaction Code grant type is not enabled in the Access Policy of the Custom Authorization server being used.
Solution
How is the missing Interaction Code grant type enabled in the access policy?
Ensure that there is a matching Access Policy for the application. Within that policy, please also ensure there is a rule that has the Interaction Code enabled in the custom authorization server's access policy rule.
The access policies can be found by going to Security > API > Authorization Servers > {Custom Authorization Server} > Access Policies. Below is a screenshot of the grant type that should be enabled:
NOTE: The Interaction Code grant type is an Okta Identity Engine (OIE) feature and does not exist in Okta Classic Engine.
