OKTA IDP and Shibboleth SP

[Cantor, Scott]

On 3/11/14, 8:24 PM, "Bhattacharjee, Raja" <Raja.Bhattacharjee at Level3.com>
wrote:
>My app override is setup as

You may have an override, but it's not being used. The entityID the SP is
running with for the responses with the breaking condition is not that
one, so your override isn't mapped to the relevant handler URL that's
processing the SAML message.

>                        handlerURL="/acmetest/Shibboleth.sso">

Given that, the responses are probably being sent to /Shibboleth.sso, and
not to that path-based version.

> Any idea what might be causing the error? Any guidance that anyone can
>provide for our
> enterprise partner in terms of populating the OKTA setup for our
>SP-initiated app 
>(https://support.okta.com/entries/23364161-Configuring-Okta-Template-SAML-
>2-0-Application)
> will be greatly appreciated since OKTA doesn¹t provide loading of SP
>metadata.

Well, they probably don't have the correct consumer service endpoint
registered. Or your SP is being told to issue a request that ends up
containing the wrong endpoint to come back to, such as if you initiate a
session from a /Shibboleth.sso/Login endpoint that is not itself part of
the app override.

That would explain why the IdP isn't complaining about being asked to
return to an unregistered location, unless the IdP itself has a bug and
isn't checking endpoints.

-- Scott