Okta missing Destination in SAML response

[Murphy, Kellen J. (wfx6yz)]

Hi Chris,

I've seen this before... and the missing "destination" element in Okta is a pretty well-known issue when you google it: https://support.okta.com/help/s/question/0D51Y00008vdbOKSAY/destination-attribute-not-set-in-samlresponse?language=en_US

And I think this comes about from using the "SAML Service Provider" template when building the integration with the IDP in Okta, which neglects to properly set Destination and IIRC doesn't give you the full set of "Advanced" options by default. Instead, there's another generic "Create New App - Web - SAML 2.0" or something like that in the Okta admin, which lets you specify the Recipient and Destination manually (see: https://help.okta.com/en-us/content/topics/apps/aiw-saml-reference.htm)

There may have been deprecations / updates to how they do things though, and I haven't looked at the Okta Admin UI since I left the consulting business. I ran into this exact problem with a number of Okta proxy configs.

Feel free to ping me in the Internet2 slack if you'd like to get another set of eyes on it sometime.


Kellen Murphy
he/him/his
Identity Architecture & Solutions Engineer

E wfx6yz at virginia.edu<mailto:wfx6yz at virginia.edu>
T +1 (434) 243-7248

University of Virginia
Information Technology Services (ITS)
Michie South
914 Emmet Street N.
P.O. Box 400217
Charlottesville, VA 22903

its.virginia.edu<https://its.virginia.edu/>

[University of Virginia]<https://brand.virginia.edu/>

[cid:3459c01c-0f9e-4a10-afcc-0f9122419783]<https://www.linkedin.com/company/uva-information-technology-services/>

________________________________
From: users <users-bounces at shibboleth.net> on behalf of Christopher Bongaarts via users <users at shibboleth.net>
Sent: Friday, December 8, 2023 1:42 PM
To: Shib Users <users at shibboleth.net>
Cc: Christopher Bongaarts <cab at umn.edu>
Subject: Okta missing Destination in SAML response

Surely others have configured a Shibboleth IdP to use SAML proxy
authentication with Okta as their IdP?

We are trying to set this up (Shib IdP 4.1.7) but are getting an error
with the SAML response from Okta:

2023-12-08 12:14:58,655 - 128.101.xx.yy - ERROR
[org.opensaml.saml.common.binding.security.impl.ReceivedEndpointSecurityHandler:170]
- Message Handler:  SAML message intended destination endpoint URI
required by binding was empty
2023-12-08 12:14:58,656 - 128.101.xx.yy - WARN
[net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:197] -
Profile Action WebFlowMessageHandlerAdaptor: Exception handling message
org.opensaml.messaging.handler.MessageHandlerException: SAML message
intended destination (required by binding) was not present
     at
org.opensaml.saml.common.binding.security.impl.ReceivedEndpointSecurityHandler.checkEndpointURI(ReceivedEndpointSecurityHandler.java:172)

We were able to confirm that there is no Destination attribute on the
SAML response.  This seems like a bug in Okta's implementation, but not
sure how anyone else would have been able to get it working.  Anyone
else tried this?  Did we miss a step somewhere?

Thanks,

--
%%  Christopher A. Bongaarts   %%  cab at umn.edu          %%
%%  OIT - Identity Management  %%  http://umn.edu/~cab  %%
%%  University of Minnesota    %%  +1 (612) 625-1809    %%

--
For Consortium Member technical support, see https://shibboleth.atlassian.net/wiki/x/ZYEpPw
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20231208/9d528549/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: Outlook-University.png
Type: image/png
Size: 21661 bytes
Desc: Outlook-University.png
URL: <http://shibboleth.net/pipermail/users/attachments/20231208/9d528549/attachment.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: Outlook-34i0w5ct.png
Type: image/png
Size: 1252 bytes
Desc: Outlook-34i0w5ct.png
URL: <http://shibboleth.net/pipermail/users/attachments/20231208/9d528549/attachment-0001.png>