Okta SAML Errors Occur When Accessing AWS Redshift Via DBeaver

Accessing the Amazon Web Services (AWS) Redshift application via DBeaver using the OktaCredentialsProvider plugin fails when the SAML assertion omits the correct Amazon Resource Name (ARN) values or an administrator misconfigures the endpoint. Resolving this requires configuring the correct Role ARN, SAML Provider ARN, group filter, and Single Sign-On (SSO) URL. Okta generates a 404 error when an administrator enables a policy, or produces the following errors:

No session token in the response

Invalid SAML response

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Amazon Web Services (AWS) Redshift
• DBeaver
• OktaCredentialsProvider plugin
• SAML

The SAML assertion from Okta lacks the correct Role ARN and SAML Provider ARN values that AWS requires, or the group filter fails to extract the role correctly. Additionally, a 404 error indicates a misconfiguration in the SAML endpoint or RelayState value.

How are the correct Amazon Resource Name values and group filter configured?

Configure the correct Role ARN, SAML Provider ARN, and group filter in the Okta Admin Console to ensure AWS accepts the SAML response.

• Format the ARN values to list the IAM Role ARN first and the SAML Provider ARN second, separating them with a comma:

• Configure the group filter in Okta to extract the role correctly. For example:

The Okta SAML endpoint and Single Sign-On URL require verification.

Verify the correct Okta SAML endpoint and ensure the SSO URL matches the AWS configuration to resolve the 404 error.

1. Navigate to Applications and select the AWS Redshift application.
2. Select the Sign On tab.
3. Select View Setup Instructions.
4. Verify that the SSO URL matches the URL that AWS uses.