A 401 error occurs during an OpenID Connect (OIDC) integration when a third-party service provider rejects a valid Okta token. Resolve this error by verifying the requested OIDC scopes and ensuring the target audience matches the service provider requirements. This error occurs after the client application successfully receives the ID token or access token from the Okta authorization server but fails to access a protected resource on the service provider. When the service provider rejects the token, the following error appears:

401 Unauthorized

• Okta Identity Engine (OIE)
• Okta Classic Engine
• OpenID Connect (OIDC)
• OAuth 2.0
• API Access Management

The 401 error occurs during OIDC Single Sign-On (SSO) due to token validation failures on the service provider side. The service provider rejects the token if it lacks the required user claims necessary to identify the user. Additionally, the error occurs if the token's audience (aud) claim differs from the exact value expected by the service provider.

How are Okta System Log events checked for successful token generation?

Verify that Okta successfully generates the OIDC tokens before contacting the service provider by reviewing the System Log.

1. Navigate to the System Log and search for the application used in the OIDC integration.
2. Verify the presence of the following token generation events:

What service provider configurations resolve the token validation failure?

Confirm the requested scopes, claims, and target audience with the service provider to ensure the token meets the validation requirements.

• Verify the client application requests all necessary OIDC scopes, such as openid, profile, and email, within the service provider configuration dashboard.
• Confirm the service provider expects the correct claim, such as email versus preferred_username.
• Check the target audience (aud) claim in the token to ensure it matches the Client ID or unique identifier expected by the service provider.

NOTE:

• When using the built-in Org Authorization Server, the (aud) claim is the Client ID of the OIDC application. The Org Authorization Server only allows standard OIDC scopes and Okta scopes, and it does not allow custom scope definitions.
• When using a Custom Authorization Server, the audience value is specified in the server settings. Specify a custom audience value in accordance with the service provider's requirements.

Related References

• OAuth 2.0 and OpenID Connect overview
• ID Token payload example
• Access Token payload example
• Okta OpenID Connect & OAuth 2.0 scopes
• Authorization Servers