Redirecting from Identity Platform SAML ACS (Integrate Okta with Google Identity Platform)

Question

I am trying to integrate a Google Identity Platform SAML provider with Okta. Typically the flow that have used to use a GIP provider, is this process where you provide the provider ID, and wait for the callback. This works correctly with Okta as an identity. However, in order to create the Okta integration, (and allow the user to click the application and be taken to the website) you need to provide the ACS(assertion consumer service), which in this case would be https://my-app-12345.firebaseapp.com/__/auth/handler however when this is posted to, and a SAML response received, there is no way to redirect to our web page. Is there a way to use the SAML Provider's ACS directly, but still return the result to a JS web page?

Answer 1

Question: I am trying to integrate a Google Identity Platform SAML provider with Okta. Typically the flow that have used to use a GIP provider, is this process where you provide the provider ID, and wait for the callback. This works correctly with Okta as an identity.

Answer:
(1) Okta supports the third party SAML identity provider such as Google Identity Platform or Shibboleth IdP.

(I) Google Identity Platform is SAML identity provider. Okta is SAML service provider.

(II) Okta is SAML identity provider. Web application (such as Office 365, Salesforce, Dropbox, Box, etc.) is SAML service provider.

(2) A user can log in to a web application via Okta by using the credential of the third party SAML identity provider of Okta.

I have validated the following user identity federation procedure for Salesforce (a web application) from the web application perspective:

(I) A user accesses their Salesforce organization domain (such as https://example.my.salesforce.com/)

(II) Select Log In with a Different Provider > Okta with Google Identity Platform

(III) The user is redirected to Google Identity Platform via Okta

(IV) The user submits their Google G Suite username/password credential (e.g., [e-mail] )

(V) The user is redirected back by Google Identity Platform and Okta, and then is logged in to their Salesforce account successfully.

Note that the user's username for Google Identity Platform, Okta account and Salesforce account is the same, i.e., [e-mail] for their organization example.com

Question: However, in order to create the Okta integration, (and allow the user to click the application and be taken to the website) you need to provide the ACS(assertion consumer service), which in this case would be https://my-app-12345.firebaseapp.com/__/auth/handler however when this is posted to, and a SAML response received, there is no way to redirect to our web page. Is there a way to use the SAML Provider's ACS directly, but still return the result to a JS web page?

Answer:
(1) As a SAML identity provider, Okta supports both SAML SP-Initiated flow and SAML IdP-Initiated flow. As a SAML service provider, Salesforce supports SAML SP-Initiated flow.

(2) In order to create the Okta integration and allow the user to click the application and be taken to the website (such as Salesforce organization domain https://example.my.salesforce.com/), you do NOT need to provide the ACS (assertion consumer service) URL, Instead, you need to provide the organization domain of Salesforce, i.e.,

Application label Salesforce.com
Instance Type Production
Custom Domain example

(3) A user can log in to a web application via Okta by using the credential of the third party SAML identity provider of Okta.

I have validated the following user identity federation procedure for Salesforce (a web application) from the Okta perspective (This is your use case):

(I) A user accesses their Okta organization domain (such as https://example.okta.com/)

(II) Click Need help signing in? and then click Log in with Google

(III) The user is redirected to Google Identity Platform

(IV) The user submits their Google G Suite username/password credential (e.g., [e-mail] )

(V) The user is redirected back and then is logged in to their Okta account successfully

(VI) On their Okta home screen, the user click Salesforce application icon

(VII) The user is redirected to their Salesforce organization domain, and then is logged in to their Salesforce account successfully.

Issue:
Quote "however when this is posted to, and a SAML response received, there is no way to redirect to our web page. Is there a way to use the SAML Provider's ACS directly, but still return the result to a JS web page?"

Resolution:
(1) This is exactly SAML SP ACS issue of your web application https://my-app-12345.firebaseapp.com/__/auth/handler.

(2) You have to either modify the SAML SP configuration of your web application or modify the SAML SP source code of your web application, because the SAML SP ACS endpoint of your web application does NOT redirect to your web application page after verifying SAML signature sent by Okta SAML IdP.

(3) I have validated the following user identity federation procedure for Shibboleth SAML SP demo application (a web application parallel to your web application) from the Okta perspective (This is your use case):

(I) A user accesses their Okta organization domain (such as https://example.okta.com/)

(II) Click Need help signing in? and then click Log in with Google

(III) The user is redirected to Google Identity Platform

(IV) The user submits their Google G Suite username/password credential (e.g., [e-mail] )

(V) The user is redirected back and then is logged in to their Okta account successfully

(VI) On their Okta home screen, the user click Shibboleth SAML SP demo application icon

(VII) The user is redirected to Shibboleth SAML SP demo application, and then is logged in to their Shibboleth SAML SP demo application successfully.

(4) The configuration of a general SAML SP application through Okta Admin GUI

Shibboleth SAML SP demo application (parallel to your web application my-app-12345.firebaseapp.com)

Applications > Shibboleth SAML SP demo > SAML Settings

Single Sign On URL https://samlsp.example.com/Shibboleth.sso/SAML2/POST
Recipient URL https://samlsp.example.com/Shibboleth.sso/SAML2/POST
Destination URL https://samlsp.example.com/Shibboleth.sso/SAML2/POST
Audience Restriction https://samlsp.example.com/Shibboleth.sso/Metadata

Note that Single Sign On URL is ACS URL of SAML SP of your web application.

(5) How to build and run Shibboleth SAML IdP and SP using Docker container at GitHub repository provides the instruction on building your own IDP for SAML in Java using Shibboleth SAML IdP and OpenLDAP.

• Shibboleth SAML IdP is responsible for identity federation.

• OpenLDAP is responsible for identity authentication.

(I) I have validated SAML Single Sign-On (SSO) provided by Docker-running Shibboleth SAML IdP (Identity Provider) and OpenLDAP for the following enterprise applications. In other words, I leveraged Docker-running Shibboleth SAML IdP and OpenLDAP to log in to the following enterprise applications successfully.

Microsoft Office 365
Google G Suite
Salesforce
Dropbox
Box
Amazon AWS
OpenStack
Citrix NetScaler
VMware vCloud Director
Oracle NetSuite

(II) I have also leveraged Docker-running Shibboleth SAML IdP and OpenLDAP to log in to Salesforce and Shibboleth SAML SP demo application via Okta successfully.

Shibboleth SAML IdP is SAML identity provider (parallel to Google Identity Platform), Okta is SAML service provider.

Okta is SAML identity provider. Web application (such as Salesforce and Shibboleth SAML SP application) is SAML service provider.

(III) For your convenience, I have made the 11th commit to upload the Okta SP metadata and corresponding SAML configuration to How to build and run Shibboleth SAML IdP and SP using Docker container.
Note that I have logged in to Salesforce organization "example.com" account (https://example.my.salesforce.com) with username "[e-mail]" successfully via Okta by using Shibboleth IdP running with Docker Container.

(IV) How to build and run Shibboleth SAML IdP and SP using Docker container provides the SAML SP configuration for SAML SP demo application.