Okta SAML Application Update via API or Terraform Causes "HTTP 500 Internal Server Error" for Users
Last Updated:
Overview
Configuring an Okta Security Assertion Markup Language (SAML) application via the Okta API or Terraform with an invalid subjectNameIdTemplate property causes an error. Reverting the configuration to use the default ${user.userName} value or saving the application configuration in the Okta Admin Console resolves the issue. When accessing the application, users receive the following error message:
500 Internal Server Error
Applies To
- Okta Identity Engine (OIE)
- Okta Classic Engine
- Security Assertion Markup Language (SAML)
- Okta API
- Terraform
Cause
The API endpoint accepts a subjectNameIdTemplate property (or subject_name_id_template in Terraform) with a default value of ${user.userName}. This property is a special reference that points to the appuser profile, even though the naming convention appears to refer to the Okta user profile. If an administrator substitutes another attribute from the Okta user profile, such as employeeNumber, Okta generates an HTTP 500 error during Single Sign-On (SSO) because Okta cannot evaluate the non-default reference properly.
Solution
How does an administrator resolve the HTTP 500 Internal Server Error?
Resolve the error by reverting the API call or Terraform configuration to use the default subject name ID template, or by saving the application configuration in the Okta Admin Console.
- Revert the API call or Terraform configuration to use the default subject name ID template by removing the invalid property or setting it to the default value.
- Alternatively, navigate to the Okta Admin Console > <Custom SAML App> > Authentication > Sign-On Settings > Edit > Attribute Statements, then press Save.
NOTE: The ${user.userName} default value correctly references the assigned username of the appuser, which appears when selecting the edit button on a user application assignment. Okta recommends always using this value so that the resulting subject remains consistent with the assignment for the user in the Okta Admin Console.
