Hi - Not sure about the cause for the error, however “Issuer” is typically defined on your Identity Provider (IDP). For example if integrating with OKTA as your IDP then in most OKTA deployments the default value for issuer is https://yourdomain.okta.com 

hope this helps!

I have setup OIDC multiple times with other vendors, and this is not a field I have ever had to enter before. So I am unsure what to put there, as we are not using Okta in this OIDC context. 

I must be honest though. I suspect another cause. “Invalid client” has a specific meaning. Can you help me track down what are possible root causes for this specific error?

Hi @byrnereese - I quickly checked with our engineers and they suggested the issue likely is with your SSO app provider, where that URL should be coming from, rather than it being your own domain (as suggested by @ruc above already).  But as much as I don’t like to post this a response in our community, this is a case where I recommend a ticket with our Support team so they can work through it and guide you directly. 

Hi @byrnereese ,

I just private messaged you what I believe could be the solution here. Let me know if it solves it!

I wanted to follow up with regards to the solution. We investigated more closely, and we noticed Gainsight did not transmit the secret is the call to the token endpoint. I am not sure if this is to spec TBH, as I have setup OIDC before and this didn’t happen with other providers, but the fix on our end was relatively simple: adjust the auth protocol to not expect the secret to be returned. 

Now everything works.