Troubleshooting Identity Provider Issues

This topic describes some common issues and errors you may encounter when working with Identity Providers.

When you encounter errors while authenticating against the K2 Identity service, the error screen may look different depending whether there is user identity context for the error, or not. If you are logging a support ticket to help troubleshoot the issue, please include the Correlation Id and, if available, the Signed-in user values to help the support team locate and identify the issue, and also provide a screenshot of the error page.

Error page with User Context

Error page without user context

Typical Identity Service Errors

The table below lists some typical errors you may encounter when authenticating with the K2 Identity service. You may need to verify that the values set in your IdP app or code are correct. If they are, please log a support ticket for further troubleshooting assistance.

Error	Typical Causes/Notes
unauthorized_client	The specified ClientId was not found in your environment configuration. Check that the value supplied for ClientId is correct. The specified RedirectUri was not found in your environment configuration or does not match the RedirectUri for the specified client. Check that the value for RedirectUri is correct. There is a grant type mismatch between the request and the client. Check the value for your specified grant type.
Invalid Login request	There are no login schemes or identity providers configured.
external_auth_failed	The external Identity Provider returned with an error.
tenant_not_found	IdentityProvider could not be found that matches the value returned by the issuer claim or the hosted domain (hd) claim
invalid_tenant	Multiple issuers were mapped to the same identity provider.
user_not_found	User could not be found in the K2 identity store. This may be because the specified user identity is not being synchronized from the Identity Provider to K2 via SCIM.
user_not_provisioned	User could not be found in the K2 identity store. This may be due to an Identity Synchronization issue, wait a few minutes and try again.
invalid_grant	The refresh token expired. See the topic SCIM integration with an Identity Provider: Manual/Custom approach for more info.