Implementing Deep Links for SAML Applications in Okta

Security Assertion Markup Language (SAML) deep links automatically redirect a user to a specific Okta application upon successful authentication via a third-party Identity Provider (IdP). Setting up this redirect requires assembling a deep link pointing directly to the desired Okta application using specific URL structures and RelayState parameters.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Deep Links
• Security Assertion Markup Language (SAML)

What are the steps to implement SAML deep links in Okta?

1. Assemble a deep link that points directly to the desired Okta application using the Service Provider Assertion Consumer Service URL, and redirect the user to the Identity Provider to implement the deep link.

https://${OktaDomain}/sso/saml2/:idpId/app/:app-location/:appId/sso/saml?RelayState=:anyUrlEncodedValue

The deep link consists of the following components.

• • Service Provider Assertion Consumer Service (SP ACS) URL.
  • Deep Link (typically, the Single Sign-On (SSO) URL found in the SAML application's sign-on instructions).
  • Inbound RelayState (this component is optional and requires URL encoding).

2. Redirect the user to the IdP with the RelayState parameter included in the URL.
3. The user logs into the IdP, and the IdP redirects the user back to Okta.
4. Okta processes the SAMLResponse from the IdP and redirects the user to the URL specified in the deep link, which automatically opens the designated application and passes along the initial RelayState if provided.

For example:

https://{org}.okta1.com/sso/saml2/0oapwt88Y42z9oYqs0g3/app/raincloud59_test_1/exkpyktH3AG1L7L9d0g3/sso/saml?RelayState=anyUrlEncodedValue

NOTE: Okta does not support additional query parameters.