SAP Knowledge Base Article - Preview

3191108 - There was an error when authenticating against the external identity provider: Invalid issuer for token did not match expected

Symptom

During browser (login) flows, the user sees the following error:
There was an error when authenticating against the external identity provider: Invalid issuer (xxxxx.accounts.ondemand.com) for token did not match expected:  https://xxxxx.accounts.ondemand.com

Prerequisites:

  1. An OIDC trust with an Identity Authentication (IAS) tenant has been configured using the "Establish Trust" button in the BTP Cockpit.
  2. The Name/Issuer of the OIDC provider has been changed in the IAS Administration Console (Application & Resources -> Tenant Settings -> OpenID Connect Configuration -> Identity Provider Settings -> Name), for example, to an issuer with or without https://.


Read more...

Environment

  • SAP Business Technology Platform.
  • Cloud Foundry Environment.
  • Identity Authentication Service.

Product

SAP Business Technology Platform all versions

Keywords

IAS, BTP, CF, OIDC, XSUAA , KBA , BC-CP-CF-SEC-IAM , UAA, Authentication, Authorization, Trust Mgmnt , Problem

About this page

This is a preview of a SAP Knowledge Base Article. Click more to access the full version on SAP for Me (Login required).

Search for additional results

Visit SAP Support Portal's SAP Notes and KBA Search.