ElliotC.72670 (Kong Inc.) asked a question.
SAML App Integrations - SP-initated flow post SAML response to the configured ACS after enabling "Signed Requests"
I have configured a SAML integration and it works fine until I have configured the "Signature Certificate" and checked "Signed Requests" options. I am being redirected to Okta App Catalog, instead of posting/redirect to the configure SSO URL/ ACS URL.
Is there any way I can see the error logs, say for the case of invalid signature of the SAML auth req?
Hi @ElliotC.72670 (Kong Inc.) , Thank you for reaching out to the Okta Community!
The Okta system logs only track the successful sending of the assertion which typically shows as "successful" - we can't validate via logs if the information is successfully received by the app/SP.
You might be able to track the login flow via the browser developer tools and I've sometimes used the "SAML Tracer" browser extension or "Fiddler" for troubleshooting. Depending on your environment and requirements the latter might be too intrusive.
If my answer helped, remember to mark it as best to increase its visibility for other members of the Okta Community who might have the same questions as you.
Hope my answer helps!
--------------------------------
The Okta Community Catalysts Program is now live. Collect online badges when you participate in the Okta Help Center Questions community. Learn more here.
Hi Mihai,
I believe the SAML response is not initiated at all and hence nothing is received by the app.
I am currently using SAML tracer and I observed the following:
{{my_okta_url}}/login/login.htm?fromURI=%2Ferror%2F400_SAML%3FstateToken%3D02.id.0uW9qVIOAxww2Sm7C7xontBHaaIOImRdZ-kO-wNW
I got this error after I enabled the options "Validate SAML requests with signature certificates." in SAML app integration in Okta. I am not sure where I can find more details about this error.
Thank you.
@ElliotC.72670 (Kong Inc.) I'm afraid this is not the proper medium for in depth troubleshooting. I suggest opening up a case to work with a Support Engineer on this. Maybe the back-end logs can shed some light on the situation.