Fixing "User Creation Was Disabled" for OIDC IdP Logins in Okta
Last Updated:
Overview
Users encounter a user creation disabled error when attempting to log in with an Identity Provider (IdP). This occurs when a user authenticates successfully, but Okta cannot find an existing account for linking, and Just-in-Time (JIT) provisioning is disabled in either the IdP configuration or at the Okta tenant level. Review the steps to enable JIT provisioning or configure custom error handling to resolve this issue.
OAuthError: User Creation Was Disabled
NOTE: This specific error code and callback behavior apply strictly to OIDC Identity Providers. SAML IdP flows handle missing account links differently and will not surface this specific OAuth error description.
Applies To
- Okta Identity Engine (OIE)
- Okta Classic Engine
- OpenID Connect (OIDC)
- Identity Provider (IdP)
- Just-in-Time (JIT) Provisioning
Cause
This error is caused by a specific setting in the OIDC IdP configuration: Just-in-Time (JIT) Provisioning is disabled.
This means that even when a user authenticates correctly with the IdP, the login fails at the final step because an existing account cannot be found for the new user (resulting in an account linking failure).
This error message is presented in two primary ways:
-
On a custom application error page: OAuthError: User creation was disabled.
-
On an Okta-hosted page, such as the Okta Dashboard: User creation was disabled.
Solution
How is JIT provisioning enabled?
Enable JIT provisioning in the OIDC IdP settings and at the Okta organization level to allow the application to automatically create accounts for new users upon their first successful login.
- Enable JIT provisioning in the OIDC IdP settings.
- Navigate to Customizations > Other in the Okta Admin Console.
- Select Enable Just In Time Provisioning to verify it is enabled at the Okta organization level.
How is custom error handling configured for applications?
Configure the application to capture the error and redirect the user programmatically when JIT must remain disabled.
- Capture the error when the user returns from the Identity Provider callback URL. The URL format appears as
http://localhost:8080/login/callback?state=xxxxxxx&error=access_denied&error_description=User+creation+was+disabled. - Redirect the user programmatically to a user-friendly page, such as the Okta sign-in page with an explanatory message, instead of showing the default error.
