Hello @xfj48 (xfj48)​,

Thanks for posting.

When there is an External Identity Provider the sign-in process goes like this:

1. In your application, the user clicks a button similar to Sign in with (Identity Provider).
2. Your application redirects the browser to Okta.
3. Okta redirects the browser to the Identity Provider.
4. The user is prompted to sign in at the Identity Provider (if they aren't already) and to accept the permissions required by your app.
5. The Identity Provider redirects the browser back to Okta.
6. Okta processes the sign-in request and adds the user to your Okta organization's Universal Directory.
7. Okta redirects the browser back to your application, just like any other sign-in request.

Based on your comment, the process is failing on step 2, since this redirect to okta and then to the IDP should be transparent for the end-users.

Please take a look at this document to make sure the whole process is correct, it also has a routing rules section:

https://developer.okta.com/docs/guides/add-an-external-idp/google/main/

If you need further assistance I recommend opening a support case where we could discuss more specific details.

Have a great day!

Natalia

Okta Inc.

Hi. Thanks for the reply. Posting a solution we received here for the benefit of others:

"Okta Admin Dashboard -> Applications -> Applications -> Kibana app -> General Settings -> SAML Settings. Click on the button found on the right side of the SAML Settings section title named Edit, and then scroll down till you find Honor Force Authentication, and set that to No."

This works correctly in our setup.