Okta Advanced Server Access Login Fails With Client User Mismatch Error
Last Updated:
Overview
An error occurs when logging into an Okta Advanced Server Access (ASA) team because the login flow expects a different username than the one associated with the active Okta Single Sign-On (SSO) session. Resolve this by verifying the expected account using the command line, clearing existing sessions, and logging in again. When a user attempts to log in to an Okta ASA team, the login fails and generates the following error message:
Client's user and current user do not match
Applies To
- Okta Identity Engine (OIE)
- Okta Classic Engine
- Okta Advanced Server Access (ASA)
Cause
The login flow expects a different Okta ASA username than the one associated with the active Okta SSO session. This mismatch occurs when a client enrolls to use multiple accounts for the same Okta ASA team.
Solution
How is the client user mismatch error resolved?
Verify the expected account using the command line interface, clear any active sessions, and log in again.
- Verify that the login request uses the expected account by running the
sft list-teamscommand. The default value indicates the account used by the login flow. For example, in the following output, the Okta ASA login flow usesuser.2:
client@hostname~ % sft list-teams
USERNAME TEAM URL ID STATUS
user.1 asa_team-name https://app.scaleft.com/v1 <id> Never used
user.2 asa_team-name https://app.scaleft.com/v1 <id> (default) Valid for 1h49m0s- Switch the username if necessary by running the
sft use <id>command. - Verify that no active Okta or Okta ASA sessions exist by performing the following actions:
- Navigate to the Okta End-User Dashboard and sign out.
- Navigate to Okta ASA Home and sign out.
- Log in to the Okta ASA team again by running the
sft logincommand. - Verify that the Okta login account matches the default client account.
