JackC.72213 (Customer) asked a question.
SAML Assertion Inline Hook failure mode
Is there actually no way to have an Application integration that is using a SAML Assertion Inline Hook to fail if the hook fails (either due to timeout or for valid scenario where the hook task cannot be processed for a given user.)
The default behavior is to pass the assertion forward with no changes. This is not acceptable behavior if the hook task does not complete this will cause possibly undefined behavior from the SP due to the assertion not conforming to expectations.
Hello @JackC.72213 (Customer) Thank you for reacting out to our Community!
At this time this seems to be expected behaviour:
"If there is a response timeout after receiving the Okta request, the Okta process flow proceeds with the original SAML assertion returned."
https://developer.okta.com/docs/reference/saml-hook/#timeout-behavior
You can submit a feature enhancement on our Idea section where it will be reviewed by our Engineering team and it might be implemented in the future.
Hope this helps and if this answered your question, please mark this as Best Answer!
It was clearly stated in the documentation that this is the expected behavior, however this behavior has severe negative impacts for our use case and we would want an option to have the handoff terminate as the downstream vendor can't handle the lack of hook execution. It leaves the assertion in an unusable state for the vendor.