Salesforce.com SCIM Provisioning - OAuth popup returns about:blank in Okta Preview org

Hello @MASRURA.96958 (Customer)​ Thank you for posting on our Community page!

The issue could be this:

"If a Sandbox environment is used in Salesforce, please navigate to the SAML Identity Type and change it from "Assertion contains the Federation ID from the User object" to "Assertion contains the User's Salesforce username".

After the process is completed, please re-authenticate the API Credentials. "

I would recommend reviewing out troubleshooting guide below which provide additional steps:

https://support.okta.com/help/s/article/salesforce-provisioning-integration-error-could-not-verify-the-salesforce-administrator-credentials-please-confirm-that-these-are-set-correctly?language=en_US

Thank you for reaching out to our Community and have a great day!

--

Help others in the community by liking or hitting Select as Best if this response helped you.

Hi Paul, thank you for your response. I followed the steps from the support article and wanted to update you on what I found:

• PKCE was already disabled on the Connected App
• SAML Identity Type was already set to 'Assertion contains the User's Salesforce username'
• OAuth Consumer Key and Secret have been verified and refreshed
• Instance Type is set to Production in Okta

Despite all of this, I'm still getting 'Could not verify the Salesforce administrator credentials' on both my Okta preview org and my Okta trial org (wgu-trial-2252077.okta.com).

I also tested the credentials directly via Postman using both password and client_credentials grant types, and both returned invalid_client_id — which suggests the issue may be on the Salesforce Developer Edition side rather than Okta.

Is there a known compatibility issue between Okta SCIM provisioning and Salesforce Developer Edition orgs? Any additional guidance would be appreciated.

Updating this response for ease of access and reference:

A configuration mismatch between the Okta instance and the Salesforce Connected App causes Salesforce to reject the Open Authorization (OAuth) handshake. Resolve this issue by verifying the callback URL, Proof Key for Code Exchange (PKCE) configuration, OAuth scopes, permitted users policy, and credential formatting. When enabling System for Cross-domain Identity Management (SCIM) provisioning on the Salesforce.com application in Okta, clicking Authenticate with Salesforce.com opens a popup that shows about:blank

and immediately closes without loading a Salesforce login page. This results in the following error:

Could not verify the Salesforce administrator credentials.

NOTE: The Okta user interface shows a green API is authenticated banner simultaneously with the red error, suggesting a state conflict.

Applies To

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Salesforce.com Application
• Provisioning
• Okta Preview

Cause

A configuration mismatch between the Okta Preview instance and the Salesforce Connected App or External Client App causes Salesforce to instantly reject the OAuth handshake before the login screen loads.

Solution

How do administrators resolve the callback URL mismatch?

Since the environment is an Okta Preview org, the administration domain ends in oktapreview.com

instead of okta.com. If the Callback URL in the Salesforce Connected App does not exactly match the Okta Preview environment, Salesforce instantly blocks the request. Verify the callback URL in the Salesforce OAuth settings by following these steps.

1. Check the Callback URL in the Salesforce OAuth settings.
2. Ensure the URL matches [https://system-admin.oktapreview.com/admin/app/generic/oauth20redirect](https://system-admin.oktapreview.com/admin/app/generic/oauth20redirect)
3. or the specific admin URL format provided by the Okta provisioning setup instructions.

Verify the PKCE configuration.

Salesforce strictly enforces PKCE for integrations. If the PKCE expectations do not match exactly on both sides, the popup fails immediately. Ensure the PKCE configuration matches in both Salesforce and Okta by following these steps.

1. In Salesforce, select Require Proof Key for Code Exchange (PKCE) extension for Supported Authorization Flows.
2. In Okta, navigate to the Provisioning > Integration tab and select the PKCE Enabled checkbox.

How do administrators verify the OAuth scopes?

If the Salesforce Connected App does not request the exact permissions Okta needs, the authorization fails silently. Verify that the Salesforce Connected App has the required scopes enabled by checking these settings.

• Enable Manage user data via APIs (api).
• Enable Perform requests at any time (refresh_token, offline_access).

Update the permitted users policy.

If administrators configure Salesforce to only allow pre-approved administrators to use the application, the OAuth flow might fail during self-authorization. Update the permitted users policy in Salesforce by following these steps.

1. In Salesforce, navigate to the Connected App Manage page and select Edit Policies.
2. Set Permitted Users to All users may self-authorize.
3. Set Refresh Token Policy to Refresh token is valid until revoked.

How do administrators remove trailing spaces in credentials?

Okta is highly sensitive to formatting. If a trailing space exists at the end of the Consumer Key or Consumer Secret when pasting them from Salesforce into Okta, Okta deems the credentials invalid and the popup fails. Remove trailing spaces by following these steps.

1. Clear the Consumer Key and Consumer Secret fields in Okta.
2. Paste the credentials again without trailing spaces.