I’ve implemented around 2017 a process in .net, that invoked the OKTA /authorize endpoint, and would receive a 302 response. Afterwards, i would get the Location/AbsoluteUri, which would give me the Identity Provider URL that i would use to authenticate the user.

The code was implemented as:

private async Task<string> GetIdentityProviderUrl(WebFingerIdentityDto dto, string redirectUri, string state)
{
    var nonce = Guid.NewGuid().ToString();
    var idp = dto.links.First()?.properties?.oktaIdpId;

    var queryParameters = new Dictionary<string, string>
    {
        {"idp", idp},
        {"client_id", _clientId},
        {"response_type", "token id_token"},
        {"response_mode", "fragment"},
        {"state", state},
        {"nonce", nonce},
        {"scope", Scopes}
    };

    var url = $"{QueryHelpers.AddQueryString(AuthorizeUrl, queryParameters)}&redirect_uri={redirectUri}";

    using var client = _clientFactory.CreateClient("okta");
    using var response = await client.GetAsync(url);

    if (!HttpStatusCode.Found.Equals(response.StatusCode))
        throw new HttpResponseException(response.StatusCode, response.ToString());

    if (string.IsNullOrEmpty(response.Headers.Location?.AbsoluteUri))
        throw new HttpResponseException(HttpStatusCode.Forbidden, "Could not obtain Location Header.");

    var queryParams = HttpUtility.ParseQueryString(response.Headers.Location?.AbsoluteUri);

    var error = queryParams.Get(ErrorKey);
    if (!string.IsNullOrEmpty(error))
        throw new HttpResponseException(HttpStatusCode.Forbidden, queryParams.Get(ErrorDescKey));

    return response.Headers.Location?.AbsoluteUri;
}

The authorize URL is something like:
https://dev-xxx.okta.com/oauth2/default/v1/authorize?idp=0oahd5oxxxpVeVXXhe5d7&client_id=0oahxxxwvoGT8i3qW5d7&response_type=token%20id_token&response_mode=fragment&state=1111&nonce=15e7641d&scope=openid&redirect_uri=https://some-url.net/callback

We had a problem with our Okta server, so we had to configure a new Application in Okta, which we configured correctly.

BUT, as soon as we tried to login, the above code no longer return 302, but instead, it returns a 200 OK.

Any idea what can be the problem? Did the /authorize API changed, and the response is not the same as before?

This is causing us a lot of problems as our clients aren’t being able to login.

Thank you in advance.