Okta Support for the SAML WantAuthnRequestsSigned Parameter

Okta does not support importing Service Provider (SP) metadata for Security Assertion Markup Language (SAML) applications, meaning Okta always sets the WantAuthnRequestsSigned parameter to false. Instead of validating signed authentication requests, Okta secures the request using the configured destination URL.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Security Assertion Markup Language (SAML) 2.0
• Custom SAML Applications

Okta Defaults the WantAuthnRequestsSigned Parameter to False

Okta always sets the WantAuthnRequestsSigned value for a custom SAML 2.0 application to false. Okta does not allow the import of SP certificates or the validation of signed authentication requests. Instead, Okta secures the authentication request using the configured destination URL.

How does a custom SAML application secure the authentication request?

Configure the destination URL to secure the authentication request. By default, Okta uses the Single Sign-On (SSO) URL as the destination URL. Assign a different destination URL by clearing the default recipient option and providing a new value.

1. Clear the Use this for Recipient URL and Destination URL checkbox.
2. Enter the new destination URL.

Okta disregards any other destination URL that a user passes with the respective authentication request.