3

I am trying to setup SAML using SP initiated sign on in OKTA (IdP) using my Windows Application (SP) however i get a 400 bad SAML request after IDP authentication of my credentials. Instead of redirecting back to the application URL (SP) i get a 400 Bad SAML request.

My SP URL - https://sampleapp.company.com/appname/default.aspx

My SAML ACS URL - https://sampleapp.company.com/appname/SAML/authenticate.aspx

ON the SP side i have added the Idp connector URL and the certificate key (no trailing spaces) to the web.config.

On the OKTA configuration I have added the SAML ACS url in all the 4 sections 1) Single sign on URL 2) Recipient URL 3) Destination URL 4) Audience URI (SP Entity ID)

Name ID format is - Unspecified. I dont see the 'Compression' menu on the configuration page. Rest of the advanced settings are kept with their default values.

I have tried playing around with the Default Relay State section as well but no use.

I hit the SP -> redirect to OKTA page -> Enter credentials -> 400 Bad SAML request.

Hit the Home button -> Hit the application chicklet -> Log into the application succesfully (this is Idp initiated) which works fine.

I have tried all the links and suggestions on the OKTA forum but cant get past this 400 bad SAML request. Is there something incorrectly set up in the OKTA configuration?

Any help would be appreciated :)

Thanks

RAnand
  • 31
  • 1

1 Answers1

1

The "Single Sign-on URL" should be the SAML ACS URL.

The Audience URI must be the entity ID of the SP, which is usually not the ACS URL.

As far as I can tell, the Recipient URL doesn't make a difference for SP-initiated flow, but I couldn't find any documentation about it.

RobSiklos
  • 8,348
  • 5
  • 47
  • 77