Arun KumarA.62811 (Customer) asked a question.
can we generate saml 2.0 form oidc token in okta
can we generate saml 2.0 form oidc token in okta
- Paul S. (Okta, Inc.)
Hello @Arun KumarA.62811 (Customer) Thank you for posting on our Community page!
At this time this is not possible to directly exchange an OIDC token for a SAML 2.0 assertion using a single API call or native token exchange in Okta.
You can also reach out via devforum.okta.com to check with our Developer team and see if there are other options for this request.
Thank you for reaching out to our Community and have a great day!
--
Help others in the community by liking or hitting Select as Best if this response helped you.
Expand Post - Arun KumarA.62811 (Customer)
@Paul S. (Okta, Inc.) thank you for the response , can u please check and confirm if below steps are possible by any means.
- Paul S. (Okta, Inc.)
Hello @Arun KumarA.62811 (Customer) Is this the type of flow you are trying to achive:
- Authenticate the user via OIDC to establish an Okta session.
- Direct the user to the SAML 2.0 application using a Service Provider (SP) initiated flow or an Identity Provider (IdP) initiated flow.
- Allow Okta to evaluate the active session and automatically generate a SAML 2.0 assertion.
- Ensure the application receives the assertion from Okta to grant access, bypassing the need for a direct token-to-assertion exchange.
Then yes this is possible.
Expand Post- Arun KumarA.62811 (Customer)
@Paul S. (Okta, Inc.) Steps we are following
- Generate OIDC tokens (id/access token) using OIDC native app
- send id/access token to backend server
- trying to generate saml from the OIDC TOKENS
OUR end goal is to generate saml2.0 from oidc
Expand Post - Paul S. (Okta, Inc.)
Hi @Arun KumarA.62811 (Customer) This question is more appropriate for our dedicated Okta Developer Forum.
My advice would be to reach out via devforum.okta.com to take advantage of their expertise.
Thank you for reaching out to our Community and have a great day!
--
Help others in the community by liking or hitting Select as Best if this response helped you.
Expand Post
- Paul S. (Okta, Inc.)
Updating this response for ease of access and reference:
Okta does not support directly exchanging an OpenID Connect (OIDC) token for a Security Assertion Markup Language (SAML) 2.0 assertion using a single API call or native token exchange. However, administrators can achieve this goal by establishing an Okta session via OIDC and directing the user to the SAML 2.0 application.
Applies To
- Okta Identity Engine (OIE)
- Okta Classic Engine
- OpenID Connect (OIDC)
- Security Assertion Markup Language (SAML) 2.0
Solution
How does Okta generate a SAML 2.0 assertion from an OIDC token?
Establish an Okta session via OIDC and direct the user to the SAML 2.0 application to allow Okta to evaluate the active session and generate a SAML 2.0 assertion.
- Authenticate the user via OIDC to establish an Okta session.
- Direct the user to the SAML 2.0 application using a Service Provider (SP) initiated flow or an Identity Provider (IdP) initiated flow.
- Allow Okta to evaluate the active session and automatically generate a SAML 2.0 assertion.
- Verify the application receives the assertion from Okta to grant access, bypassing the need for a direct token-to-assertion exchange.
For additional options, visit the Okta Developer Forum.
Expand Post
Updating this response for ease of access and reference:
Okta does not support directly exchanging an OpenID Connect (OIDC) token for a Security Assertion Markup Language (SAML) 2.0 assertion using a single API call or native token exchange. However, administrators can achieve this goal by establishing an Okta session via OIDC and directing the user to the SAML 2.0 application.
Applies To
Solution
How does Okta generate a SAML 2.0 assertion from an OIDC token?
Establish an Okta session via OIDC and direct the user to the SAML 2.0 application to allow Okta to evaluate the active session and generate a SAML 2.0 assertion.
For additional options, visit the Okta Developer Forum.