MilanD.01195 (Customer) asked a question.
In SAML guidelines https://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf
section 3.4.1 Element <AuthnRequest>
Element AssertionConsumerServiceURL 2061 says
"Specifies by value the location to which the <Response> message MUST be returned to the requester"
Which I believe Okta is not adhere to,
In my SAML Request, which looks like following,
<?xml version="1.0" encoding="UTF-8"?>
<saml2p:AuthnRequest AssertionConsumerServiceURL="http://localhost:8080/core-demo/login?idpId=OKTA-demo&host=localhost%3A8080" Destination="https://dev-<masked>.okta.com/app/dev-<masked>_coredemo_2/<masked>/sso/saml" ID="_3eabaae6d0c7543c625cc2083133be5a" IsPassive="false" IssueInstant="2022-08-31T10:46:27.514Z" ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Version="2.0" xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol">
<saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">core-demo</saml2:Issuer>
<saml2p:NameIDPolicy AllowCreate="true" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent" />
</saml2p:AuthnRequest>
AssertionConsumerServiceURL is http://localhost:8080/core-demo/login?idpId=OKTA-demo&host=localhost%3A8080
But response is NOT sent to this URL (http://localhost:8080/core-demo/login?idpId=OKTA-demo&host=localhost:8080), instead it goes to SingleSignOnURL.
If I have same SP creating different AssertionConsumerServiceURL for parameter `hosts` then it's something that OKTA cannot do.
Hello @MilanD.01195 (Customer),
Thank you for reaching out!
The best route to pursue regarding your inquiry would be to create a ticket with our support team in order to properly investigate the behavior that you are encountering. Also, I would recommend trying to capture a SAML trace or a HAR file in order for the support team to be able to see the flow and identify the root cause of the issue.
Additionally, I have provided below a documentation that contains information about SAML, which might be useful :
Hi @User16594883323548314840 (Okta Integration Network) I had created ticket with OKTA and multiple iterations of issue demonstration and legit proof I was asked to pay for Profession services - which I cannot do at this point.
What do you think next steps are?
https://support.okta.com/help/s/case/5004z00001fuvQ8AAI/okta-saml-configuration-not-respecting-assertionconsumerserviceurl-when-sending-response-back-to-sp?language=en_US
Case Id 01494923