https://descope.com logo
Join Slack
Powered by
Hey team, A client of mine uses Okta as an IDP and...
# ask-a-descoper
t
Hey team, A client of mine uses Okta as an IDP and has logged in to the app before. Now, all the users in their tenant get the error message:
Copy code
{
  "errorCode": "E061206",
  "errorDescription": "Missing redirect URL for IdP initiated login",
  "errorMessage": "Post Authentication Redirect URL cannot be empty for IdP initiated, check your SAML settings",
  "message": "Post Authentication Redirect URL cannot be empty for IdP initiated, check your SAML settings"
}
I looked for this error in this channel and other ones, and I found that Post Authentication Redirect URL is needed. But we never set it before in our app/per tenant. I don't see any audit for those users. How can we further investigate? project id 
P2mvO2smJcUY5UZ4n6qnK3Pnu7OT
the tenant with the issue 
T2z2QngPNiI7UiN8HBW00DK0rzgY
r
Hi @Tal Mikey Let me check
m
@Tal Mikey did you setup 
IdP initiated
? https://docs.descope.com/sso/idp-initiated
IdP initiated
is not the same , make sure you see the diff between https://www.descope.com/blog/post/idp-vs-sp-sso
IdP initiated
requires some setup , as in the doc
t
So the users logged in before via the Okta dashboard/extension. Both sides haven't change anything. Do you have any logs that can provide additional data?
d
Do you have the post authentication url defined? Can it be that someone deleted it?
You can look at the audit log for SAMLSettings events, you won't see what exactly changed but you will see that someone modified the settings
t
AFAIK no one changed it
In the 
Audit and Troubleshoot
? I can't filter by 
SAMLSettings
type Can you provide an explicit way to see the logs?
d
Yes that's the only way to see the audit and logs. You can also stream these logs to your monitoring system (datadog, etc). https://docs.descope.com/audit-trails-and-integrations/audit-trail-streaming
But did you set the post auth url back?
This is how the audit log event should looks like:
For your project I see the change in the SSO (SAML) Project Settings: Date: December 18, 2025 Time: 124940 PM (Israel Time) The update was done from the Descope Console UI User ID performed this update: 
U2mvO2dXou0WvMNJigBUbacdxLAY
User display name performed this update: 
gal@terra.security
* You have all this data in your audit event. * I really recommend to work with dev/staging/prod envs (using pulumi, etc), and DO NOT do any manual changes in production, this is a bed practice and affects your production. I also really recommend to stream the audit and troubleshooting logs to your monitoring system I also see, that you did not fix it yet, to fix it just add back the post auth redirect URL as described here. @Tal Mikey @Gal Malachi
t
Thank you for your help, I appreciate it !
👍 1
2 Views
Open in Slack
PreviousNext
Powered by