"This identity provider does not support this redirect workflow" error blocking SSO logins

[FASupportBot]

After a recent deployment or configuration change, users are unable to log in via SSO and receive the error message:

"This identity provider does not support this redirect workflow"

This is affecting multiple end users attempting SSO authentication. What causes this error and how can it be resolved?

[FASupportBot]

This error typically indicates a mismatch between the identity provider configuration and the authentication workflow being attempted.

Common causes:

1. Redirect URI mismatch — The redirect URI configured in your identity provider doesn't match what FusionAuth is sending during the authentication request. The redirect URI in your authentication request must exactly match one of the Authorized Redirect URLs configured in your application's OAuth configuration.

2. Identity provider type misconfiguration — The identity provider type (SAML v2, OpenID Connect, etc.) may not support the redirect-based flow being used

3. Missing or incorrect configuration — Required fields in the identity provider configuration may be missing or misconfigured

4. Wrong login method selected — If you're using the /api/identity-provider/login endpoint, ensure the correct Login Method is configured in the Identity Provider settings

5. Flow initiated from wrong starting point — The login flow must start at FusionAuth, not directly at the external Identity Provider. Going directly to a third-party IdP URL (e.g., directly to Google or Azure OAuth URLs) bypasses FusionAuth's session handling and will fail.

Resolution steps:

1. Verify the identity provider configuration in FusionAuth matches your external IdP settings exactly
2. Check that redirect URIs are correctly configured on both sides — navigate to Applications → [Your Application] → OAuth tab and ensure the Authorized Redirect URLs are properly set
3. Confirm the identity provider type supports the authentication flow you're attempting
4. Enable debug mode on the Identity Provider (Settings → Identity Providers → [Your IdP] → Enable debug mode) and review FusionAuth event logs (System → Event Log) for more detailed error information
5. If this started after a recent change, review what was modified in the identity provider configuration
6. Ensure users are starting the login flow from FusionAuth's hosted login pages or proper OAuth authorize endpoint, not bypassing FusionAuth to go directly to the external IdP

If the issue persists, gather the full error details from the FusionAuth event log with debug mode enabled and review your identity provider configuration against the FusionAuth documentation for your specific IdP type.

Related Documentation

• Troubleshooting Identity Provider Configuration — General troubleshooting guide for IdP issues
• Add an OpenID Connect Identity Provider — Configuration guide for OIDC IdPs
• Host a SAML v2 Identity Provider — SAML configuration and troubleshooting
• Enabling Debugging — How to enable debug mode for detailed error logging
• Identity Provider APIs — API reference for programmatic IdP configuration