# Fix Okta E0000004 authentication failed on SAML login

## TL;DR
E0000004 is Okta's generic authentication-failed event: the user presented credentials Okta rejected, before any SAML assertion was ever built. Do not chase the service provider config first. Open the Okta system log, find the failed login event and its reason (bad password, MFA, policy), fix that, and confirm the user can log in to Okta directly. Only then retry the SAML flow.

## The error
```text
Okta System Log: user.session.start  -  Outcome: FAILURE
Result code: E0000004 (Authentication failed)
Legacy event type: core.user_auth.login_failed
```

## Use this skill
Agent? Search Vectle for this error:
```bash
curl -s "https://vectle.com/api/v1/search?q=okta%20error%20e0000004%20authentication%20failed%20saml"
```

## Fix it

### Step 1: Read the failed event in the system log

```bash
In Okta Admin / Reports / System Log, filter by the user and a tight time window around the failure, and open the E0000004 event detail.
```

Expected: the event names a reason - invalid credentials, MFA challenge failed, or a sign-on policy denial. The reason picks the fix.

### Step 2: Fix the credential or policy issue

```bash
Wrong password - reset it or have the user retry carefully. MFA failure: check enrollment and the factor used. Policy denial: review Security / Authentication / sign-on policies for the app and network zone.
```

Expected: the underlying auth blocker is removed, not worked around.

### Step 3: Confirm direct Okta login works

```bash
Have the user log in to the Okta dashboard (not the SAML app) with the same credentials.
```

Expected: dashboard login succeeds. If it fails here, the problem is purely Okta-side auth and the SAML app is irrelevant.

### Step 4: Retry the SAML flow

```bash
Have the user retry the service-provider login and watch the system log for a successful assertion event.
```

Expected: login completes. If E0000004 is gone but a new error appears at the SP, that is a separate issue - the auth step is fixed.

### Step 5: Check for fleet-wide causes if many users fail

```bash
If the failures cluster, check the Okta status page and review recent sign-on policy or MFA policy changes.
```

Expected: either an external incident or a recent policy change explains the cluster.

## When this applies

- Okta system log shows E0000004 on the login event
- SAML login fails but the SP never receives an assertion
- Direct Okta dashboard login also fails

## When it doesn't

- The SP rejects a valid assertion (ACS, audience, signature errors - SP-side)
- The log shows E0000006 access denied (authorization, not authentication)
- The user never reaches Okta (network or DNS issue)

## Compatibility

Okta SAML 2.0 apps, IdP-initiated and SP-initiated flows. Also surfaces for delegated authentication (AD/LDAP) failures.

## Variant phrasings

### okta e0000004 login failed

Same event. Always start in the system log; the event detail carries the actual reason.

### saml sso authentication failed okta

If the failure happens before the assertion, it is Okta-side auth. If after, it is SP-side assertion handling.

## Why it happens

E0000004 fires at the authentication step, which comes before SAML assertion generation in Okta's pipeline. Wrong passwords, failed MFA, sign-on policy denials, and broken delegated auth all surface here. Because the failure precedes the assertion, no amount of SP-side debugging (certificates, ACS URLs, attribute statements) can fix it.

## Edge cases

- E0000004 vs E0000006: authentication failed vs access denied need different fixes; check the code, not just the symptom
- API-driven logins (authn API) log the same code with a different client field
- Delegated AD auth failures appear as E0000004 when the AD bind fails; check the AD agent too

## If it still fails

- Capture the exact timestamp, the username, and the full error from the system log before changing anything else.
- Reproduce with a single test user so you are not debugging a crowd.
- If it worked before, diff the config against the last known good, then open a vendor ticket with the timestamp and request id. Never send secrets or private keys.

## Prevention

- Track credential and certificate expiry with alerts, not memory.
- Run a synthetic check per app daily so breakage pages you, not a user.
- Document mappings, URLs, and runbook steps where the next admin will find them.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_XsUMoDtThaxOzlfKyeFQ_Q