Culture Amp Custom SAML App Does Not Support Okta IdP-Initiated Flows
Last Updated:
Overview
When attempting to launch a new Culture Amp Custom SAML application directly from the Okta End-User Dashboard, the authentication fails. This occurs because new integrations configured by administrators through the Culture Amp self-service option only support Service Provider (SP)- initiated flows, as Culture Amp no longer accepts manual OIN integration requests via their support team. To resolve this, administrators must configure a Bookmark App to simulate an Identity Provider (IdP) initiated flow or direct users to initiate the login from the Culture Amp SP directly.
Applies To
- Okta Identity Engine (OIE)
- Okta Classic Engine
- Security Assertion Markup Language (SAML)
- Culture Amp Custom SAML Application
- Single Sign-On (SSO)
Cause
The Culture Amp self-service option for Custom SAML applications only supports SP-initiated SAML flows and rejects IdP-initiated authentication requests. Culture Amp no longer accepts the previous method of sending Okta Integration Network (OIN) integration details to their support team.
Solution
How is the Culture Amp authentication flow configured for Custom SAML apps?
Because the Culture Amp self-service Custom SAML application requires an SP-initiated flow, users must navigate directly to the Culture Amp login page to authenticate. To provide a seamless experience from the Okta End-User Dashboard, administrators can hide the standard SAML application and deploy a Bookmark App that points to the Culture Amp SP-initiated login URL.
Hide the Custom SAML application, add a Bookmark App from the Okta Integration Network (OIN), and configure the application with the Culture Amp login URL to simulate the expected user experience.
- Open the Okta Admin Console and navigate to the Culture Amp Custom SAML application.
- Select the General tab and edit the App Embeds settings to hide the application from users.
- Navigate to the OIN and add a Bookmark App.
- Enter the Culture Amp SP-initiated login URL in the URL field of the Bookmark App configuration.
- Assign the Bookmark App to the required users to simulate an IdP-initiated login experience.
