<iframe src="https://www.googletagmanager.com/ns.html?id=GTM-M74D8PB" height="0" width="0" style="display:none;visibility:hidden">
Loading
Skip to NavigationSkip to Main Content
System Status
Announcements
Announcements
Search
Search
Select Language
Knowledge Base
Knowledge Articles
Support Videos ↗
Documentation
Product Documentation ↗
Developer Documentation ↗
Product Release Notes ↗
Community
Events & Webinars
Okta Ideas ↗
Resources
Product Hub
Customer Success Hub
Product Release Update
Learning
Okta Learning ↗
Get Support
Open a Case
HomeCommunityForum
0D50Z00008G7UkGSAVOkta Classic EngineLifecycle ManagementAnswered2024-03-25T07:22:56.000Z2017-11-01T17:12:19.000Z2020-07-17T13:06:26.000Z

AndrewT.17044 (Customer) asked a question.

Edited by varun.kavoori1.5210444522562532E12 September 5, 2018 at 1:19 AM
Requestable SSO URLs, from SP perspective
Not seeing any documentation on Requestable SSO URLs, so looking to better understand them:

 

I have multi-tenant application which (in a particular case) uses the SAME entityid, with the same IdP. Multiple tenancy is determined by domain name, for example 'abc.example.com', and 'xyz.example.com'

 

I want my SSO URLs to differ (i.e., use different domain names) depending on which tenant is making the request. If request originates from 'abc.example.com', my SSO URL is 'https://abc.example.com/saml/sso'

 

It appears I can do this by setting:  Then in my request, I set entitiy id to 'example.com' -- for both of my domains -- and set service.sp.endpoints.assertion_consumer_service to 'https://abc.example.com/saml/sso' for one domain, and 'https://xyz.example.com/saml/sso' for the other domain.

 

While each of the two requestable SSO URLs must have different index values, it does not appear I need to do anything about specifying and index in the request. Right?

 

What is the purpose of the Index? For IdP-initiated login, how does IdP / Okta "know" which URL to use by default?

 

  • 3 answers
  • 4.64K views

  • alexandru.preda1.485391231955779E12 (Okta, Inc.)

    Hi Andrew,

     

    The request for a specific ACS URL can be done directly via requesting the URL in the request you send or by requesting the Index for the URL, as some vendors does not support request by URL.

     

    The request of a specific ACS URL is only done in an SP intiated flow, as the IDP intiated flow the defaul URL used wil be the Single sign on URL defined in your application. 

     

    Thank You,

     

    Alexandru Preda

    Technical Support Engineer

    Okta Global Customer Care

     

    Expand Post
    Selected as Best

  • alexandru.preda1.485391231955779E12 (Okta, Inc.)

    Hi Andrew,

     

    The request for a specific ACS URL can be done directly via requesting the URL in the request you send or by requesting the Index for the URL, as some vendors does not support request by URL.

     

    The request of a specific ACS URL is only done in an SP intiated flow, as the IDP intiated flow the defaul URL used wil be the Single sign on URL defined in your application. 

     

    Thank You,

     

    Alexandru Preda

    Technical Support Engineer

    Okta Global Customer Care

     

    Expand Post
    Selected as Best

    • oza1p (oza1p)

      • How to know SP intiated flow or IDP intiated slow?
      • Why IDP intiated flow used default SSO URL ?
This question is closed.
Loading
Requestable SSO URLs, from SP perspective