<iframe src="https://www.googletagmanager.com/ns.html?id=GTM-M74D8PB" height="0" width="0" style="display:none;visibility:hidden">
Loading
Skip to NavigationSkip to Main Content
0D51Y00008vfSkXSAUOkta Classic EngineAdministrationAnswered2024-03-25T07:22:56.000Z2020-07-17T10:35:38.000Z2020-07-20T04:56:52.000Z

oza1p (oza1p) asked a question.

Purpose of Requestable SSO URLs and How to use Requestable SSO URLs?

I Configure Requestable SSO URLs in okta application but whats is the actual purpose of Requestable SSO URLs and when it used for redirection.


  • sandeepk.84743 (Wipro Technologies)

    Hi Ankit

     

    Assume you have multi-tenant application which (in a particular case) uses the SAME entityid, with the same IdP. Multiple tenancy is determined by domain name, for example 'abc.example.com', and 'xyz.example.com' you want the SSO URLs to differ (i.e., use different domain names) depending on which tenant is making the request. If request originates from 'abc.example.com', my SSO URL is 'https://abc.example.com/saml/sso' It appears I can do this by setting: 

     Then in my request, I set entity id to 'example.com' -- for both of my domains -- and set service.sp.endpoints.assertion_consumer_service to 'https://abc.example.com/saml/sso' for one domain, and 'https://xyz.example.com/saml/sso' for the other domain. While each of the two requestable SSO URLs must have different index values.

     

    The request for a specific ACS URL can be done directly via requesting the URL in the request you send or by requesting the Index for the URL, as some vendors does not support request by URL. The request of a specific ACS URL is only done in an SP initiated flow, as the IDP initiated flow the default URL used will be the Single sign on URL defined in your application. 

     

    So in a Nut Shell, Requestable URL's are the ACS URL's of your SP with different domains & index values. There are some multi tenant applications which follow this.

    I hope it helps.

    Expand Post
    Selected as Best
  • sandeepk.84743 (Wipro Technologies)

    Hi Ankit

     

    Assume you have multi-tenant application which (in a particular case) uses the SAME entityid, with the same IdP. Multiple tenancy is determined by domain name, for example 'abc.example.com', and 'xyz.example.com' you want the SSO URLs to differ (i.e., use different domain names) depending on which tenant is making the request. If request originates from 'abc.example.com', my SSO URL is 'https://abc.example.com/saml/sso' It appears I can do this by setting: 

     Then in my request, I set entity id to 'example.com' -- for both of my domains -- and set service.sp.endpoints.assertion_consumer_service to 'https://abc.example.com/saml/sso' for one domain, and 'https://xyz.example.com/saml/sso' for the other domain. While each of the two requestable SSO URLs must have different index values.

     

    The request for a specific ACS URL can be done directly via requesting the URL in the request you send or by requesting the Index for the URL, as some vendors does not support request by URL. The request of a specific ACS URL is only done in an SP initiated flow, as the IDP initiated flow the default URL used will be the Single sign on URL defined in your application. 

     

    So in a Nut Shell, Requestable URL's are the ACS URL's of your SP with different domains & index values. There are some multi tenant applications which follow this.

    I hope it helps.

    Expand Post
    Selected as Best
    • oza1p (oza1p)

      Please provide okta idp login url sample to understand how to pass entity id and asc url in login url parameter.

This question is closed.
Loading
Purpose of Requestable SSO URLs and How to use Requestable SSO URLs?