Is OSP running on the same box as IGA? (Does not have to).

Dos the certificate used for SSL on  the IGA server have the Subject Alternate name that nmtches the URL you start on (iga.domain.td)?

See how OAUth issuer is servername, but the the URL is iga?  before the domain.td parts?  Should be consistent and the same.

OSP is running on the same box as IGA and we do use a certificate with common name "iga.domain.td" and with SAN "server.domain.td".

I tried changeing all config (URLs, Hosts) in IGA to be the same as "server.domain.iga" and then it works, but thats not how i want it to bee ... I'll about to try changeing the certificate to only common name

It seems that the "Oauth Issuer" name does not come from any config. How is it created/choosen by the application?

SAN should include:

iga.domain.td

server.domain.td

And if you have a cluster with multiple nodes, each nodes name as well, in case you ever need to try to connect to a node directly...  (Easy to change ism-conifg file, harder to change a Cert after the fact).

I am ran into same issue today and found your post during troubleshooting.   I took same approach, where the fqdn used in IG config was different from the servername.  I had both URLs as SANs in the certificate.   

I suspect if we raised the osp log level you'd see the mismatch there too.  The solution was to the configuration parameter: com.netiq.idm.osp.tenant.http-interfaces=url:port/osp  to the ism-configuration.properties file. 

This is same approach as detailed here, where same issue can happen with the identity apps:  https://support.microfocus.com/kb/doc.php?id=7024305

This likely to late to help you, but posting here should others come across the same thread.

So for additional context... The URL you connect to, must exactly match the ism-configuration.properties file entry you mentioned.  And the hostname must exactly (Though I Think this one is case insensitive) the Subject Alternate Name in the cert.

The port however poses problems.  This is because all modern browsers, if you type "">https://test.com:443/" will re-write that for you (arn't they helpful) to "">https://test.com/" since the 443 is ugly and not requried as the default port.