<div dir="ltr"><div class="gmail_extra"><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">>Is the flow here SP->IdP, and if so, can you add in a trace of an AuthnRequest that's triggering the response?<br></blockquote><div>Yup, should be SP->IdP and here's the http request that triggers the SAML auth</div><div>GET <a href="https://myserver.com/">https://myserver.com/</a> HTTP/1.1</div><div>Host: <a href="http://myserver.com">myserver.com</a></div><div>User-Agent: A browser of some type. :)</div><div>Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8</div><div>Accept-Language: en-US,en;q=0.5</div><div>Accept-Encoding: gzip, deflate</div><div><br></div><div>HTTP/?.? 302 Found</div><div>Date: Fri, 14 Aug 2015 16:29:25 GMT</div><div>Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.1e-fips</div><div>Expires: Wed, 01 Jan 1997 12:00:00 GMT</div><div>Cache-Control: private,no-store,no-cache,max-age=0</div><div>Location: <a href="https://company.okta.com/app/okta_app/oktaid123454/sso/saml?SAMLRequest=fZJPb%2BIwEMW%2FSuQ7cZLlr0WQ2HJYJJZFQHvoBTn2QAyJ7fU4bfj2TUhRW6nq1Z55v3lvZoq8LCybVz7XW%2FhfAfqgLguN7PaRksppZjgqZJqXgMwLtpv%2FXbEkjJh1xhthChLMEcF5ZfSD0ViV4HbgXpSAx%2B0qJbn3FhmlCKLnmp76GorCVDKU8BLavP4VnuSJ7nKVZaYAn4eIhraQhG7%2B7fYkWDRTKc1b%2FQ%2B1k5FcymtoLp6HwpSUW3t%2FPCh9NA2uox1iCvUlFv7Ms%2FNwfdna4TmqR7TFtC5JsFyk5JD0J%2FFomI3kOMlgEo9lPzryJJLHbAAQ9UdNGWIFS42ea5%2BSJIoHvWjci%2Fv7eMiSCUsGzyTYvGfyW2mp9OnnALOuCNmf%2FX7T68w%2BgcOb0aaAzKbtgOwGdp8W87Msv2%2BDzO5pcctFDl3836Q%2FpZ84HdSydSO8XGxMocQ1mBeFeX1wwD2kJCZ01rV8PZ3ZGw%3D%3D&RelayState=ss%3Amem%3A7e7e341f48dfb6f4b945fa4776f59b131261101b8de3ccef9e869a533e0f15b2&SigAlg=http%3A%2F%2Fwww.w3.org%2F2000%2F09%2Fxmldsig%23rsa-sha1&Signature=i17MymbVxz21g63A3Cp%2B1tBP%2F%2F5L%2B0WFq5slUkAIRovX28Ma%2FLHPaKWCTedj2MkVNbtM2I3CdQwh1FzNRhdru6TeiK1Z%2F6RdygL%2BVfsR3jM1RTtnL5HshYc%2BrfV1rcIHfUb79pUg5V0r6eYMQPPo9vgQ7KZeUUnQ1uwbREDxrwCcIqbU33S%2FTKdz2riqa791kHE4oHXEbmCsxX7WoTl2UY2gTy9E%2BP49GEtKpFfhNmzThtGI9IzqNZ9jqWpmF%2Fl%2FHhDUfSU70mRT1r8LdX3Gxq%2By0yncvZJBkbJ18oHapQkAWvYMUloYGt74OPVjk5ctzG18IZyWnzaKDq0cBv%2F5tg%3D%3D">https://company.okta.com/app/okta_app/oktaid123454/sso/saml?SAMLRequest=fZJPb%2BIwEMW%2FSuQ7cZLlr0WQ2HJYJJZFQHvoBTn2QAyJ7fU4bfj2TUhRW6nq1Z55v3lvZoq8LCybVz7XW%2FhfAfqgLguN7PaRksppZjgqZJqXgMwLtpv%2FXbEkjJh1xhthChLMEcF5ZfSD0ViV4HbgXpSAx%2B0qJbn3FhmlCKLnmp76GorCVDKU8BLavP4VnuSJ7nKVZaYAn4eIhraQhG7%2B7fYkWDRTKc1b%2FQ%2B1k5FcymtoLp6HwpSUW3t%2FPCh9NA2uox1iCvUlFv7Ms%2FNwfdna4TmqR7TFtC5JsFyk5JD0J%2FFomI3kOMlgEo9lPzryJJLHbAAQ9UdNGWIFS42ea5%2BSJIoHvWjci%2Fv7eMiSCUsGzyTYvGfyW2mp9OnnALOuCNmf%2FX7T68w%2BgcOb0aaAzKbtgOwGdp8W87Msv2%2BDzO5pcctFDl3836Q%2FpZ84HdSydSO8XGxMocQ1mBeFeX1wwD2kJCZ01rV8PZ3ZGw%3D%3D&RelayState=ss%3Amem%3A7e7e341f48dfb6f4b945fa4776f59b131261101b8de3ccef9e869a533e0f15b2&SigAlg=http%3A%2F%2Fwww.w3.org%2F2000%2F09%2Fxmldsig%23rsa-sha1&Signature=i17MymbVxz21g63A3Cp%2B1tBP%2F%2F5L%2B0WFq5slUkAIRovX28Ma%2FLHPaKWCTedj2MkVNbtM2I3CdQwh1FzNRhdru6TeiK1Z%2F6RdygL%2BVfsR3jM1RTtnL5HshYc%2BrfV1rcIHfUb79pUg5V0r6eYMQPPo9vgQ7KZeUUnQ1uwbREDxrwCcIqbU33S%2FTKdz2riqa791kHE4oHXEbmCsxX7WoTl2UY2gTy9E%2BP49GEtKpFfhNmzThtGI9IzqNZ9jqWpmF%2Fl%2FHhDUfSU70mRT1r8LdX3Gxq%2By0yncvZJBkbJ18oHapQkAWvYMUloYGt74OPVjk5ctzG18IZyWnzaKDq0cBv%2F5tg%3D%3D</a></div><div>Content-Length: 1351</div><div>Keep-Alive: timeout=5, max=100</div><div>Connection: Keep-Alive</div><div>Content-Type: text/html; charset=iso-8859-1</div><div><br></div><div><br></div><div>And following the 302 to the location, this is the SAML data that goes with it</div><div><samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"</div><div>                    AssertionConsumerServiceURL="<a href="https://myserver.com/Shibboleth.sso/SAML2/POST">https://myserver.com/Shibboleth.sso/SAML2/POST</a>"</div><div>                    Destination="<a href="https://company.okta.com/app/okta_app/oktaid123454/sso/saml">https://company.okta.com/app/okta_app/oktaid123454/sso/saml</a>"</div><div>                    ID="_249176b7d82be918d40fa20dfb5ee047"</div><div>                    IssueInstant="2015-08-14T16:29:25Z"</div><div>                    ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"</div><div>                    Version="2.0"</div><div>                    ></div><div>    <saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"><a href="https://myserver.com">https://myserver.com</a></saml:Issuer></div><div>    <samlp:NameIDPolicy AllowCreate="1" /></div><div></samlp:AuthnRequest> </div></div><br></div></div>