Add Additional Requestable SSO URLs in an Okta Custom SAML Application
Last Updated:
Overview
Requestable Single Sign-On (SSO) URLs enable SSO for multi-tenant applications with different domain names while using the same Entity ID and Identity Provider (IdP). For example, a multi-tenant application uses the domain names <abc.example.com> and <xyz.example.com>. Administrators diversify the SSO URLs based on the tenant initiating the request by configuring the custom Security Assertion Markup Language (SAML) application settings in Okta. This configuration supports both Service Provider (SP) initiated and IdP-initiated workflows by managing Assertion Consumer Service (ACS) URLs with varying domains and index values.
Applies To
- Okta Identity Engine (OIE)
- Okta Classic Engine
- Security Assertion Markup Language (SAML)
- Custom SAML Application
- Requestable SSO URLs
- Single Sign-On (SSO)
Solution
How are additional Requestable SSO URLs configured in a custom SAML application?
Follow the video or steps to configure these URLs.
-
Navigate to Applications > Application and search for the application.
-
Go to the General Tab of the app > click the Edit button located in the SAML Settings section.
-
Click Next.
-
On the new page that appears, click on the Show Advanced Settings link.
-
After the advanced settings menu is expanded, the Other Requestable SSO URLs option becomes visible.
-
Click on the Add Another button in order to start adding the URLs.
NOTE: Each of the Requestable SSO URLs must have different index values.
How do Requestable SSO URLs function in SP-initiated and IdP-initiated flows?
Understand the dynamics of Requestable SSO URLs by reviewing their specific behaviors in both SP-initiated and IdP-initiated flows.
- SP-Initiated Flow: The SAML request specifies a specific ACS URL directly or through index referencing. The ACS URL manages the SAML responses from the IdP.
- IdP-Initiated Flow: The IdP initiates the SSO and deploys the default Single Sign-On URL configured in the application.
NOTE: When using SP-initiated sign-in flows, input the ACS URLs for any other requestable SSO nodes required by the app integration. Define both a unique URL and an index for each ACS URL endpoint. If the SAML AuthnRequest messages do not specify either an index or a URL, Okta directs the SAML Response to the ACS identified in the Single Sign-On URL field. Upon activating Signed Requests, Okta purges any predefined static SSO URLs and extracts the SSO URLs from the authenticated SAML request. Static and dynamic SSO URLs cannot coexist.
