I've seen a few posts regarding this topic, however they do not appear to solve my issue. I also have a posting on the developer forum.

I'm setting up our authentication provider to allow users to access Salesforce with our enterprise network credentials - grant type of authentication code. I currently have an authentication provider setup in Salesforce and a client setup in the authentication provider. When loading the provided test url, I'm sent to the auth provider to login. Successful login results in (from what I can tell) a well-formed authentication response - contains state and code parameters. The next endpoint is the URL I entered as the error url in the Salesforce configuration for the authentication provider with 3 parameters:

  • ErrorCode=No_Openid_Response
  • ErrorDescription=Bad+response
  • ProviderId={{ID of the auth provider configuration in SF}}

The issue appears to be Salesforce rejecting the authentication response which is preventing it from executing the token request.

I've attempted to decode the authentication response to see if there are mal-formed characters or anything, but not seeing how to do so.

I've verified the signed certification authority on our authentication provider is an allowed authority by Salesforce as well.

I'm looking for a way to troubleshoot this or suggestions on issues.

enter image description here


It appears the issue was due to a user attribute added to the authentication provider's mapping. I need this to match against salesforce to identify a user, so not sure why that did/is not working. That said, it does not appear to be a Salesforce issue at this point.


I ran into the same error today. In my case the problem was that my OpenID Connect OP was configured to return the UserInfo as a signed JWT. I disabled signing so that the data would be returned as a JSON object and everything started working as expected.

  • jbelassai, How did you disable signing on JWT? Jul 22 '18 at 19:09
  • The way you do that depends on what product you are using for your OpenID Connect Provider (OP). In my case, it was RapidIdentity from Identity Automation and disabling signing is something which can be configured on a per-client basis.
    – jbellassai
    Jul 23 '18 at 21:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.