<iframe src="https://www.googletagmanager.com/ns.html?id=GTM-M74D8PB" height="0" width="0" style="display:none;visibility:hidden">
Loading
Skip to NavigationSkip to Main Content
System Status
Announcements
Announcements
Search
Search
Select Language
Knowledge Base
Knowledge Articles
Support Videos ↗
Documentation
Product Documentation ↗
Developer Documentation ↗
Product Release Notes ↗
Community
Events & Webinars
Okta Ideas ↗
Resources
Product Hub
Customer Success Hub
Product Release Update
Learning
Okta Learning ↗
Get Support
Open a Case
HomeCommunityForum
0D50Z00008C3jaGSAROkta Classic EngineOkta Integration NetworkAnswered2024-04-15T13:27:27.000Z2016-07-15T13:32:39.000Z2018-12-19T12:00:34.000Z

MiteshJ.22605 (Customer) asked a question.

Edited by varun.kavoori1.5210444522562532E12 September 5, 2018 at 1:19 AM
Getting RequestDenied status in SLO response
Hi,

 

We are using standard SAML request response to authenticate users in our application. We are allowing users to login through three identity providers - OneLogin, OKTA and Azure Active Directory. SSO is working fine for all of them. regarding SLO, it is also working fine for OneLogin and Azure AD. But In case of OKTA, We are getting RequestDenied status in SLO response.

 

As OKTA asks for public key certificate to unable SLO. We are new with this certificates. We are confused that what we should provide as a certificate. We tried X.509 certificate that we got from OKTA metadata but it doesnt accept that and invalidate that certificate. then we tried for a sample certificate that was created before. OKTA accepted that certificate but by using that we are getting Requestdenied error. We also tried HTTP-POST and HTTP-Redirect both as Protocol-binding but that didn't solved the issue.

 

It will be great if we have some information of what certificate should be uploaded to OKTA for SLO, what certificate we should pass we request, how to sign SAML request etc.

 

Also we are confused with 'SP Issuer' used for logout. Is it the same issuer what OKTA metadata provides?

 

Thanks,

Mitesh J.
  • 5 answers
  • 1.78K views

  • gabriel.sroka1.4374539321839353E12 (Okta, Inc.)

    Hi Mitesh

    Okta is acting as a SAML IdP (Identity Provider). For SLO, it needs the certificate of the SAML SP (Service Provider), that is, the app that Okta is providing SSO for.

     

    For example, if Okta is providing SSO to Box.com, then Okta is the IdP and Box.com is the SP.

     

    Check out:

    https://support.okta.com/help/articles/Knowledge_Article/Using-the-App-Integration-Wizard
    Expand Post

  • MiteshJ.22605 (Customer)

    Hi Gabriel

     

    Thanks for the quick reply.

     

    We downloaded X.509 certificate from instruction page of okta admin site(page displayed by clicking on 'View Setup instructions' button on sign-on setting page of an okta application). and uploaded that certificate as a signature certificate for logout. Still we are getting same issue - Request denied.

     

    Are we using the right certificate? if no, where can i find SAML SP certificate that you mentioned above?

     

    One thing, in some comments related to this issue, i found that we need to sign LogOut request and send it to OKTA. How we can sign a request message? Can you please provide any sample for that? 

     

    It will be great if you provide any sample code for SLO.

     

    Thanks,

    Mitesh
    Expand Post

  • gabriel.sroka1.4374539321839353E12 (Okta, Inc.)

    Hi Mitesh,

    When configuring SLO in Okta, you need to provide the SP's certificate. This should be available from the SP, check their documentation.

    Which SP are you using?

  • 2a4bz (2a4bz)

    You need an SSL Cert in the PEM .pem format, like from a CA cert authority. Or the SP can give you one.

  • BrijeshS.00569 (Hexagon)

    Hi Team,

     

    Is there any update on this query? Because we are also facing the same issue as others here... We have our own ADFS (public access endpoint) as SP and we have uploaded the cer file for our IDP in OKTA Logout URL. However it still gives the same 403 Access denied page.

     

     

     

    When I have changed that to use the global OKTA Sign-out URL. It signout.

    Expand Post
This question is closed.
Loading
Getting RequestDenied status in SLO response