Hi Ankit,

This is Marius with Okta support. The multiple requestable SSO URLs are for use in SP-initiated sign-in flows. Select this option to configure multiple ACS URLs to support applications capable of choosing where the SAML Response is sent. Specify an index or URL to uniquely identify each ACS URL endpoint. If an AuthnRequest message does not specify an index or URL, the SAML Response is sent to the default ACS URL specified in the Single sign on URL field.

If you're still encountering issues in configuring the custom SAML app, I would advise you to create a support ticket with us so we can discuss this more thoroughly.

Thank you,

Marius Dinu

Okta T2 TSE

Hi Marius Dinu,

Below is my okta sso url.

{BaseURL}/sso/saml?RelayState=xyz&redirect_uri={url}

• I am passing above url for signin in okta but how to set ACS URL or Index in my sign in url.
• suppose my Requestable SSO Urls is https://abc.com and https://xyz.com so how to pass specific url in SSO sign in URL.
• please provide one example for sso login url with ACS URl/Index for more understanding.

Hi Ankit,

I ran across this post while looking for a way to utilize the Requestable SSO URLs and I thought I might reply with what I learned in case any one else stumbles across this post as well.

In short, if you are reading this, chances are you can't make use of these URLs. To use these URLs, either the application natively supports this (refer to your application's documentation), or you are the developer of the application (refer to the SAML protocol specification).

If the application already supports this feature you probably aren't looking at this post. The documentation of the application you are using will tell you how to configure the URLs in Okta and the index numbers in the application. You would just enter the correct index number(s) into the SAML configuration of the application, the correct URLs into Okta and things work.

If you are the developer of the web application you probably aren't looking at this post either. You will be looking at the SAML Protocol specification, Assertions and Protocols for the OASIS Security Assertion Markup Language (SAML) V2.0 (opens new window), and referring to the AssertionConsumerServiceIndex Optional Attribute that you can include in the AuthnRequest as follows.

AssertionConsumerServiceIndex[Optional]

• Indirectly identifies the location to which the <Response> message should be returned to therequester. It applies only to profiles in which the requester is different from the presenter, such as theWeb Browser SSO profile in [SAMLProf]. The identity provider MUST have a trusted means to mapthe index value in the attribute to a location associated with the requester. [SAMLMeta] provides onepossible mechanism. If omitted, then the identity provider MUST return the <Response> message tothe default location associated with the requester for the profile of use. If the index specified is invalid,then the identity provider MAY return an error <Response> or it MAY use the default location. Thisattribute is mutually exclusive with the AssertionConsumerServiceURL and ProtocolBindingattributes.

I hope this helps anyone else that finds this.