To resolve sign-in and authorization problems in IdP authentication mode, use the following information:

Message Cause Resolution
Your identity provider did not return an email address. Contact your IdP Administrator. The identity provider did not supply an email address for the user. In the identity provider, include the email scope and ensure that the email claim is issued for the OpenEdge Command Center application.
User does not have API access / Error while fetching recently discovered resources. The user exists in the identity provider but is not assigned any OpenEdge Command Center app role. Assign an app role to the user, or a group that contains the user. See Required IdP app roles for OpenEdge Command Center.
Access denied. The app role value in the access token does not match any role that is defined in OpenEdge Command Center. Correct the app role value in the identity provider so that it matches the OpenEdge Command Center role value exactly, including case.
Authentication service unavailable. Try again later. The identity provider is unreachable, or the OIDC discovery document cannot be retrieved from the issuer URL.
  1. Verify network connectivity from the OpenEdge Command Center server to the identity provider.
  2. Verify that the issuer URL serves a valid discovery document.
Authentication failed. Please try again. The sign-in could not be verified, usually because it was started from a browser tab that is no longer current, or because it was not completed in time.
  1. Start the sign-in again from the OpenEdge Command Center login page.
  2. Confirm that browser cookies are enabled.
Authentication configuration error. Contact system admin. The active authentication configuration is incomplete or invalid.
  1. Review the stored configuration with SWITCHAUTHMODE --LIST.
  2. Correct the values, activate the configuration, and restart the server.

Consider the following additional conditions:

  • Roles that were changed in the identity provider are not applied—A role change takes effect when OpenEdge Command Center next renews the access of the user, or at the next sign-in of that user.
  • Users are prompted to sign in again about every hour—The offline_access scope is missing, so the identity provider does not issue a refresh token. Add the scope to the configuration.
  • Roles cannot be read from the access token—The identity provider issued an opaque access token instead of a JWT.
    • For Microsoft Entra ID, expose the custom API scope, set the requested access token version to 2, and do not request Microsoft Graph scopes in the same request.
    • For Okta, use a custom authorization server.
Note: In IdP authentication mode, POST /api/auth/login and POST /api/auth/refresh_token are blocked. These endpoints are not a future gap.