OIDC Authorization Error: "error=access_denied&error_description=User+is+not+authorized"

Products

• SITEMINDER

Issue/Introduction

When attempting an OIDC authorization flow (e.g., calling the /authorize endpoint), the user is redirected to the redirect_uri with the following error after successfully entering credentials and providing consent:

error=access_denied&error_description=User+is+not+authorized

 

Log Observations

Policy Server Trace Log (smtracedefault.log): The logs show a successful authentication (AuthAccept) followed by an authorization failure during the OIDC provider check:

text

[Sm_Az_Message.cpp:622][CSm_Az_Message::SendReply][s6923/r15][oidcp:OIDC_Auth_Provider][][sample-user1][][oidcp:OIDC_Auth_Provider_az][oidcp:OIDC_Auth_Provider]...[** Status: Not Authorized. ]

Access Log (smaccess.log):

text

[Az][AzAccept] ... [/affwebservices/redirectjsp/redirect.jsp?response_type=code&scope=openid&client_id=...] ... [federation_redirectjsp_policydomain]

 

Environment

Policy Server: All versions

Cause

The issue is caused by the user directory configuration within the OIDC Provider settings.

In SiteMinder OIDC configurations, the Authentication and Authorization section of the Provider setup requires a user directory to be mapped. Even if the user is successfully authenticated by a separate authentication scheme, they must also be authorized against the user directory configured in the Provider. If the user is missing from that directory, or if an Exclusion filter is applied that includes the user, the Policy Server will return a "Not Authorized" status.

Resolution

To resolve this issue, ensure the user directory is correctly configured to authorize the impacted users:

1. Log in to the Administrative UI.
2. Navigate to Federation > Partnership Federation > OIDC Providers.
3. Open the specific Provider configuration used by the client.
4. Go to the Authentication and Authorization section (or tab).
5. Verify that the User Directory containing your test users is added to the list.
6. Check for any Exclusions:
   • Ensure the specific user or group is not explicitly excluded.
   • If using filters, verify that the filter correctly evaluates the user's attributes.
7. Save the configuration and allow time for the Policy Server to update its cache (or flush the cache manually).
8. Re-test the authorization flow.