Shibboleth proxy to Okta IDP issues

[Jewett, David]

Christopher,

Thanks for your help! My Okta metadata was valid, but I fixed an issue with the ACS URL on the Okta side and that got it working.

Dave

From: users <users-bounces at shibboleth.net> On Behalf Of Christopher Bongaarts via users
Sent: Friday, February 23, 2024 7:23 PM
To: users at shibboleth.net
Cc: Christopher Bongaarts <cab at umn.edu>
Subject: Re: Shibboleth proxy to Okta IDP issues


[EXTERNAL EMAIL WARNING] DO NOT CLICK LINKS or open attachments unless you recognize the sender and know the content is safe.
It says it loaded your metadata file, but it doesn't say it loaded an EntityDescriptor with an id="http://www.okta.com/exk137opma7Z4PsLC0x8"<https://urldefense.com/v3/__http:/www.okta.com/exk137opma7Z4PsLC0x8__;!!K6Z8K8YTIA!FD6ocYlhY9FXQsVuY06Tyrep9HhzdxIgbyg2sTfN6iYr974u-MHDrkp4WKAzbpFVBmMIg1jlocsq6WtfCA$> (which is what you've set your Okta IdP entity ID in the proxy settings in the shib IdP according to the logs) and an SPSSODescriptor element.

Double check the Okta IdP metadata file...

On 2/23/2024 4:54 PM, Jewett, David via users wrote:
I’ve been tasked with implementing proxying from our Shib IDP to Okta, to provide MFA for specific Shibboleth SPs. I have a test IDP running 4.3.1, and I’ve followed the SAMLAuthnConfiguration wiki docs for 4.0:

https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1282539600/SAMLAuthnConfiguration<https://urldefense.com/v3/__https:/shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1282539600/SAMLAuthnConfiguration__;!!K6Z8K8YTIA!FD6ocYlhY9FXQsVuY06Tyrep9HhzdxIgbyg2sTfN6iYr974u-MHDrkp4WKAzbpFVBmMIg1jlocuLfgTfIQ$>

and the “Using SAML Proxying to another IdP” wiki article as well, with the understanding that some configuration may be out of date for 4.1:

https://shibboleth.atlassian.net/wiki/spaces/KB/pages/1459979597/Using+SAML+Proxying+to+another+IdP<https://urldefense.com/v3/__https:/shibboleth.atlassian.net/wiki/spaces/KB/pages/1459979597/Using*SAML*Proxying*to*another*IdP__;KysrKys!!K6Z8K8YTIA!FD6ocYlhY9FXQsVuY06Tyrep9HhzdxIgbyg2sTfN6iYr974u-MHDrkp4WKAzbpFVBmMIg1jlocsae8YW5A$>

Per the above article, I created a Shib-sp-metadata.xml file and included the following in Metadata-providers.xml:

                <MetadataProvider id="ShibSPMetadata"  xsi:type="FilesystemMetadataProvider" metadataFile="%{idp.home}/metadata/sp-metadata.xml"/>

                <MetadataProvider id="OktaIDPMetadata"  xsi:type="FilesystemMetadataProvider" metadataFile="%{idp.home}/metadata/OktaIDPmetadata.xml"/>

After configuration according to the documentation, when accessing an SP authentication at the upstream IDP succeeds, but my Shib IDP responds with “Web Login Service – Unsupported request. The application you have accessed is not registered for use with this service.”

My logs show that my upstream IDP’s metadata is being loaded, as is the metadata for the Shib SP:



--

%%  Christopher A. Bongaarts   %%  cab at umn.edu<mailto:cab at umn.edu>          %%

%%  OIT - Identity Management  %%  http://umn.edu/~cab<https://urldefense.com/v3/__http:/umn.edu/*cab__;fg!!K6Z8K8YTIA!FD6ocYlhY9FXQsVuY06Tyrep9HhzdxIgbyg2sTfN6iYr974u-MHDrkp4WKAzbpFVBmMIg1jlocs5fY9ORg$>  %%

%%  University of Minnesota    %%  +1 (612) 625-1809    %%
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20240226/54ff9af3/attachment.htm>