Okta 400 Error User Creation Was Disabled For Existing Users During OIDC IdP Login

When users attempt to log in via an external OpenID Connect (OIDC) Identity Provider (IdP), Okta generates a 400 error stating that user creation is disabled. This occurs for existing, active users because the IdP sends an incorrect attribute for matching, prompting Okta to attempt Just-In-Time (JIT) provisioning. The following error message appears during the login attempt:

User creation was disabled

• Okta Identity Engine (OIE)
• Okta Classic Engine
• OpenID Connect (OIDC)
• Identity Provider (IdP)
• Just-In-Time (JIT) Provisioning

The external OIDC IdP sends an incorrect attribute for matching. Because the incoming claim does not match an existing user in Okta, Okta assumes it is a new user and attempts JIT provisioning. Since JIT provisioning is disabled for the IdP, Okta generates the 400 error.

How is the OIDC IdP matching attribute corrected?

Verify the claim mapping and update the Identity Provider matching settings by following these steps:

1. Navigate to Security > Identity Providers in the Okta Admin Console.
2. Select the external OIDC IdP and choose Edit.
3. Locate the Match Against setting.
4. Verify that the attribute selected for matching corresponds to the correct claim sent by the external IdP.
5. Update the claim mapping or the matching attribute to ensure the incoming claim matches the existing Okta user profile.
6. Save the changes and test the login flow.