Fixing "User Creation Was Disabled" for OIDC IdP Logins in Okta
Last Updated:
Overview
When a user attempts to log in with an Identity Provider (IdP), they may encounter the following error:
OAuthError: User Creation Was Disabled
This happens when a user authenticates successfully, but no existing account is found for linking, and Just-in-Time (JIT) provisioning is disabled in either the IdP configuration or at the Okta tenant level.
Applies To
- OpenID Connect (OIDC)
- Identity Provider (IdP)
- Just-in-Time (JIT) Provisioning
- Okta Classic Engine
- Okta Identity Engine (OIE)
Cause
This error is caused by a specific setting in the OIDC IdP configuration: Just-in-Time (JIT) Provisioning is disabled.
This means that even when a user authenticates correctly with the IdP, the login fails at the final step because an existing account cannot be found for the new user (resulting in an account linking failure).
This error message is presented in two primary ways:
-
On a custom application error page: OAuthError: User creation was disabled.
-
On an Okta-hosted page, such as the Okta Dashboard: User creation was disabled.
Solution
There are two ways to fix this error:
- Enable JIT Provisioning. The simplest solution is to turn on Just-in-Time (JIT) provisioning in the OIDC IdP settings. This allows the application to automatically create accounts for new users upon their first successful login, resolving the error immediately.
If JIT Provisioning is enabled on the OIDC IDP settings, also verify that it's enabled at the Okta Org level by going to Customizations > Other > Enable Just In Time Provisioning in the Okta Admin Console.
- Custom Error Handling for Apps.
For custom applications where JIT must remain disabled, please handle the error in the code. Configure the application to:
- Capture the error when the user returns from the Identity Provider's callback URL, which will be in the format:
http://localhost:8080/login/callback?state=xxxxxxx&error=access_denied&error_description=User+creation+was+disabled. - Redirect the user programmatically to a user-friendly page, such as the Okta sign-in page with an explanatory message, instead of showing the default error.
