4y8tu (4y8tu) asked a question.
What is the Relay State for the Oracle Cloud Infrastructure app (SAML 2.0)?
I have set up SSO for Oracle Cloud Infrastructure (OCI) according to the instructions here:
https://saml-doc.okta.com/SAML_Docs/How-to-Configure-SAML-2.0-for-Oracle-Cloud-Infrastructure.html
I can now log in to OCI using Okta as the identity provider, so that's good.
One minor thing I can't figure out though, is that when I try to access OCI by clicking on the OCI app in the Okta dashboard, I get the following response:
{
"code" : "InvalidParameter",
"message" : "Request does not contain any relay state. Are you using idp-initiated flow?"
}
Based on the Okta logs, it appears that I have successfully authenticated, but I don't understand what this "relay state" problem is or how to fix it.
The RelayState it's referring to is likely this (not an answer, but hopefully a hint?)
https://support.oracle.com/knowledge/Oracle%20Cloud/2497983_1.html
Also, IDP doesn't use a relay state:
so maybe it's saying that it got a relay state attribute that it wasn't expecting, or vice versa. It looks like the first flow with relaystate is only for SSO initiated from OCI, and IdP is for Okta type SSO?
It's my understanding (now) that OCI does not support IdP initiated SSO; that's why this doesn't work.
I think the most reasonable option at this point is to hide the OCI chiclet on the Okta dashboard, and optionally provide a custom chiclet that is simply a link to the OCI SSO login page.