>

SSO (OTKA) configuration troubleshooting

Answered
Marc Horner

Hi team,  we are struggling with SSO (OKTA) configuration for a new implementation - NA Prod: Ewing Marion Kauffman Foundation.

Metadata has been added using both URL and file upload methods but when we go to test URL we are receiving the below error:

If they try to login with the Okta tile (they realize IDP initiated logins are not supported by AWS/Elite) they also receive a generic error saying, “Invalid samlResponse or relayState from identity provider”.

Any assistance (or direction to an internal resource with SSO configuration knowledge) would be greatly appreciated.

 

Comments

7 comments

Date Votes
  • Marc Horner

    Hi @... are you able to assist with this one at all? 

  • Marc Horner
    Edited

    Hi Elizabeth Fox are you able assist with this one?

  • Matt Brindle

    Hola Marc Horner 
    I'm so sorry for the delay, I've been away sick. Is this post the one you escalated into the Product Teams channel and therefore answered or is it a different customer and need?
    Marc Horner: SSO Error & IdP question

  • Marc Horner

    Hi @... that's the one.  Engineering are in direct contact with the client to troubleshoot, once I see it is working again I will post the summary of how it was rectified (and might add it to the SSO troubleshooting KB as well). 

     

  • Matt Brindle

    Wonderful, thanks Marc Horner 

  • Marc Horner

    Closing the loop on this one:

    Initial issue: Client database was not pointing to the correct location.  This needed to be updated by engineering in the AWS Cognito console.

    Secondary issue: Oka configuration: 

    Based on this article - https://support.okta.com/help/s/article/attribute-claims-mapping-with-custom-saml-application?language=en_US the name field (the name on the additional attribute that needs to be added) should contain the Uri and then the Name Format should be set to unspecified. 

    This then resulted in a successful log in with the test URL in Elite and success for all users once SSO had been enforced.

    Notes on SSO in general - During the sales process if SSO is raised, we need to clarify that Elite only supports SP initiated SSO (where you initiate log in from Elite) and does not support IdP initiated login - where you login form the SSO provider platform (like we are able to do with My Apps internally) - this was part of the issue with this particular client who assumed that IdP would be available (our Elite KB already states this is not the case). 

     

     

  • Matt Brindle

    Great follow-up and summary, thanks Marc Horner :)

Please sign in to leave a comment.

Didn't find what you were looking for?

New post