Okta Single Log Out Fails With "FAILURE: Inavlid nameID" Error
Last Updated:
Overview
Okta fails the Single Log Out (SLO) process when the string values in the application assignment differ from the values the application expects. Applying a language expression to update the username format to a lowercase string resolves the issue. Okta generates the following error when a user attempts to log out:
FAILURE: Inavlid nameID
Applies To
- Okta Identity Engine (OIE)
- Okta Classic Engine
- Single Sign-On (SSO)
- Single Log Out (SLO)
- Application Assignment
Cause
The application assignment contains different string values than the application expects. Single Sign-On (SSO) functions correctly because the application does not treat the username as case-sensitive when matching the user. However, when the Single Log Out triggers, Okta requires an exact match between the string of the username from the application and the exact value in the application assignment. For example, if the user is <testTestingTest@test1.com> in Okta, but the username on the application side is entirely lowercase, the Single Log Out fails.
Solution
How is the username format updated to resolve the Single Log Out error?
Update the application username format with a custom expression that converts the username into a lowercase string.
- Review the process to update the application username format with a custom expression.
- Enter the following expression:
String.toLowerCase(user.login)
NOTE: Replace the user.login attribute depending on the specific use case.
