Shibboleth proxy to Okta IDP issues

[Christopher Bongaarts]

It says it loaded your metadata file, but it doesn't say it loaded an 
EntityDescriptor with an id="http://www.okta.com/exk137opma7Z4PsLC0x8" 
(which is what you've set your Okta IdP entity ID in the proxy settings 
in the shib IdP according to the logs) and an SPSSODescriptor element.

Double check the Okta IdP metadata file...

On 2/23/2024 4:54 PM, Jewett, David via users wrote:
>
> I’ve been tasked with implementing proxying from our Shib IDP to Okta, 
> to provide MFA for specific Shibboleth SPs. I have a test IDP running 
> 4.3.1, and I’ve followed the SAMLAuthnConfiguration wiki docs for 4.0:
>
> https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1282539600/SAMLAuthnConfiguration
>
> and the “Using SAML Proxying to another IdP” wiki article as well, 
> with the understanding that some configuration may be out of date for 4.1:
>
> https://shibboleth.atlassian.net/wiki/spaces/KB/pages/1459979597/Using+SAML+Proxying+to+another+IdP
>
> Per the above article, I created a Shib-sp-metadata.xml file and 
> included the following in Metadata-providers.xml:
>
>                 <MetadataProvider id="ShibSPMetadata"  
> xsi:type="FilesystemMetadataProvider" 
> metadataFile="%{idp.home}/metadata/sp-metadata.xml"/>
>
>                 <MetadataProvider id="OktaIDPMetadata"  
> xsi:type="FilesystemMetadataProvider" 
> metadataFile="%{idp.home}/metadata/OktaIDPmetadata.xml"/>
>
> After configuration according to the documentation, when accessing an 
> SP authentication at the upstream IDP succeeds, but my Shib IDP 
> responds with “Web Login Service – Unsupported request. The 
> application you have accessed is not registered for use with this 
> service.”
>
> My logs show that my upstream IDP’s metadata is being loaded, as is 
> the metadata for the Shib SP:
>

-- 
%%  Christopher A. Bongaarts   %%cab at umn.edu           %%
%%  OIT - Identity Management  %%http://umn.edu/~cab   %%
%%  University of Minnesota    %%  +1 (612) 625-1809    %%
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20240223/9452b15a/attachment.htm>