title: configuring saml-sample (SP) to work with Okta (IdP)
body: <p>Okta is an IdP for SAML logins. I have a super-admin user of Okta.</p>
  
  <p>I try to use Spring's saml-sample project as my SP (service-provider). When I configure it (spring-saml-sample) in the Okta system, I need to supply some data on my SP, such as "post back URL", "recipient" and "audience restriction".</p>
  
  <p>After sniffing in Okta's docs, I found this:</p>
  
  <p><strong>Audience Restriction</strong> – This is the entity id of the Service Provider. It will be provided by the SP and must match exactly. Consult the SP documentation to get this information.</p>
  
  <p><strong>Recipient</strong> –Enter the service provider’s assertion consumer service URL . Consult the SP documentation to get this information.
  So I figured out that this URL should be:
  <a href="http://srv101.watchdox.net/spring-security-saml2-sample/saml/SSO/alias/defaultAlias" rel="nofollow">http://srv101.watchdox.net/spring-security-saml2-sample/saml/SSO/alias/defaultAlias</a></p>
  
  <p><strong>Post Back URL</strong> – This is the SAML SP endpoint (i.e. where your users will log in)</p>
  
  <p><strong>Destination for the SAML response</strong> – This is the intended destination of the saml assertion. Unless specified by the SP, this will typically be identical to the post back URL. Consult the SP documentation to get this information. </p>
  
  <p>The Problem:</p>
  
  <p>My app (spring-saml-sample) has a "welcome" page, where the user chooses the IdP he wants to login with. So I choose "Okta" IdP, and then i am redirected to the Okta to log-in (perfect till here), but after login, instead of redirecting me back to my app (to the protected resource), I stay in the Okta system and see their framework. I do see my app there. When I click on it, I get to my first page, to choose the IdP.</p>
  
  <p>I believe the problem is with my URLs, or with the SAML response...
  Anyonw has an idea?</p>
  
  <p>Pasted here the Request and response, if might be helpfull.</p>
  
  <p>I pasted here the SAML requests and responses, in case it might be helpfull. Note that the Status Code in the response is "Success"!</p>
  
  <p>What can be wrong? what am I missing?</p>
  
  <p>Request:</p>
  
  <pre><code>POST https://watchdox.okta.com/app/template_saml_2_0/k3gvyf0mGFVVCVQBYTTA/sso/saml HTTP/1.1
  Host: watchdox.okta.com
  User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:20.0) Gecko/20100101 Firefox/20.0
  Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
  Accept-Language: en-US,en;q=0.5
  Accept-Encoding: gzip, deflate
  Referer: https://srv101.watchdox.net/spring-security-saml2-sample/saml/login/alias/defaultAlias?idp=http%3A%2F%2Fwww.okta.com%2Fk3gvyf0mGFVVCVQBYTTA
  Content-Type: application/x-www-form-urlencoded
  Content-Length: 3906
  
  HTTP/?.? 200 OK
  Server: nginx/1.2.6
  Date: Thu, 18 Apr 2013 08:49:39 GMT
  Content-Type: text/html;charset=utf-8
  Transfer-Encoding: chunked
  Connection: keep-alive
  P3P: CP="HONK"
  Set-Cookie: sid=""; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
  t=default; Path=/
  X-Okta-backend: webapp09e.prod.saasure.com
  Cache-Control: no-cache, public
  Pragma: no-cache
  Expires: 0
  Content-Language: en-US
  Content-Encoding: gzip
  </code></pre>
  
  <p>SAML request:</p>
  
  <pre><code>&lt;saml2p:AuthnRequest xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol"
                       AssertionConsumerServiceURL="https://srv101.watchdox.net:443/spring-security-saml2-sample/saml/SSO/alias/defaultAlias"
                       Destination="https://watchdox.okta.com/app/template_saml_2_0/k3gvyf0mGFVVCVQBYTTA/sso/saml"
                       ForceAuthn="false"
                       ID="a32a5d9jfge33c9b46gdaddid8gd41b"
                       IsPassive="false"
                       IssueInstant="2013-04-18T08:49:38.141Z"
                       ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
                       Version="2.0"
                       &gt;
      &lt;saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"&gt;com.watchdox.ohad&lt;/saml2:Issuer&gt;
      &lt;ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"&gt;
          &lt;ds:SignedInfo&gt;
              &lt;ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /&gt;
              &lt;ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /&gt;
              &lt;ds:Reference URI="#a32a5d9jfge33c9b46gdaddid8gd41b"&gt;
                  &lt;ds:Transforms&gt;
                      &lt;ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /&gt;
                      &lt;ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /&gt;
                  &lt;/ds:Transforms&gt;
                  &lt;ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /&gt;
                  &lt;ds:DigestValue&gt;blwZT1B5451jbzeB9m0ogyGQuFY=&lt;/ds:DigestValue&gt;
              &lt;/ds:Reference&gt;
          &lt;/ds:SignedInfo&gt;
          &lt;ds:SignatureValue&gt;RZeXySsMfy+iBglUngrCHg2XoaA4WzAkLrB/zhjRfqFQS45avePlF8f19N+MHoFSirI08R08lXNJqdT/+0tKEujwsluCzFMnOCVPhtZIs7DblxqD+nR0XmF9+fKt91z/KQRtGLQtO/bsl3X3dmkUULGUWBxi8ga9jyTnkGwMFjE8J/Ba0P9eZjLV9YV/Piui/3B1XbhezVIIAvPNOpwQzK1kSA19bwlSejCjsf1Xe9kLXoCdf56ykjGDSdj2HpEVKQcjbu2nfPTFAXRTehx6h5qiKVl5R1DdDtFfq9EOXpZgy5pcu4bHqDhNAMwhZCu57fIIRR5IWuC6YUAXTDFXbg==&lt;/ds:SignatureValue&gt;
          &lt;ds:KeyInfo&gt;
              &lt;ds:X509Data&gt;
                  &lt;ds:X509Certificate&gt;MIIDUjCCAjqgAwIBAgIEUOLIQTANBgkqhkiG9w0BAQUFADBrMQswCQYDVQQGEwJGSTEQMA4GA1UE
  CBMHVXVzaW1hYTERMA8GA1UEBxMISGVsc2lua2kxGDAWBgNVBAoTD1JNNSBTb2Z0d2FyZSBPeTEM
  MAoGA1UECwwDUiZEMQ8wDQYDVQQDEwZhcG9sbG8wHhcNMTMwMTAxMTEyODAxWhcNMjIxMjMwMTEy
  ODAxWjBrMQswCQYDVQQGEwJGSTEQMA4GA1UECBMHVXVzaW1hYTERMA8GA1UEBxMISGVsc2lua2kx
  GDAWBgNVBAoTD1JNNSBTb2Z0d2FyZSBPeTEMMAoGA1UECwwDUiZEMQ8wDQYDVQQDEwZhcG9sbG8w
  ggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCXqP0wqL2Ai1haeTj0alwsLafhrDtUt00E
  5xc7kdD7PISRA270ZmpYMB4W24Uk2QkuwaBp6dI/yRdUvPfOT45YZrqIxMe2451PAQWtEKWF5Z13
  F0J4/lB71TtrzyH94RnqSHXFfvRN8EY/rzuEzrpZrHdtNs9LRyLqcRTXMMO4z7QghBuxh3K5gu7K
  qxpHx6No83WNZj4B3gvWLRWv05nbXh/F9YMeQClTX1iBNAhLQxWhwXMKB4u1iPQ/KSaal3R26pON
  UUmu1qVtU1quQozSTPD8HvsDqGG19v2+/N3uf5dRYtvEPfwXN3wIY+/R93vBA6lnl5nTctZIRsyg
  0Gv5AgMBAAEwDQYJKoZIhvcNAQEFBQADggEBAFQwAAYUjso1VwjDc2kypK/RRcB8bMAUUIG0hLGL
  82IvnKouGixGqAcULwQKIvTs6uGmlgbSG6Gn5ROb2mlBztXqQ49zRvi5qWNRttir6eyqwRFGOM6A
  8rxj3Jhxi2Vb/MJn7XzeVHHLzA1sV5hwl/2PLnaL2h9WyG9QwBbwtmkMEqUt/dgixKb1Rvby/tBu
  RogWgPONNSACiW+Z5o8UdAOqNMZQozD/i1gOjBXoF0F5OksjQN7xoQZLj9xXefxCFQ69FPcFDeEW
  bHwSoBy5hLPNALaEUoa5zPDwlixwRjFQTc5XXaRpgIjy/2gsL8+Y5QRhyXnLqgO67BlLYW/GuHE=&lt;/ds:X509Certificate&gt;
              &lt;/ds:X509Data&gt;
          &lt;/ds:KeyInfo&gt;
      &lt;/ds:Signature&gt;
  &lt;/saml2p:AuthnRequest&gt;
  </code></pre>
  
  <p>Okta response:</p>
  
  <pre><code>POST http://srv101.watchdox.net/spring-security-saml2-sample/ HTTP/1.1
  Host: srv101.watchdox.net
  User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:20.0) Gecko/20100101 Firefox/20.0
  Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
  Accept-Language: en-US,en;q=0.5
  Accept-Encoding: gzip, deflate
  Content-Type: application/x-www-form-urlencoded
  Content-Length: 7863
  
  HTTP/?.? 302 Found
  Date: Thu, 18 Apr 2013 08:51:57 GMT
  Server: Apache
  Location: https://srv101.watchdox.net/spring-security-saml2-sample/
  Content-Length: 241
  Keep-Alive: timeout=30, max=100
  Connection: Keep-Alive
  Content-Type: text/html; charset=iso-8859-1
  </code></pre>
  
  <p>SAML Response:</p>
  
  <pre><code>&lt;saml2p:Response xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol"
                   Destination="http://srv101.watchdox.net/spring-security-saml2-sample/"
                   ID="id141234960903909491594058959"
                   InResponseTo="a32a5d9jfge33c9b46gdaddid8gd41b"
                   IssueInstant="2013-04-18T08:51:49.819Z"
                   Version="2.0"
                   &gt;
      &lt;saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"
                    Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity"
                    &gt;http://www.okta.com/k3gvyf0mGFVVCVQBYTTA&lt;/saml2:Issuer&gt;
      &lt;ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"&gt;
          &lt;ds:SignedInfo&gt;
              &lt;ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /&gt;
              &lt;ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /&gt;
              &lt;ds:Reference URI="#id141234960903909491594058959"&gt;
                  &lt;ds:Transforms&gt;
                      &lt;ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /&gt;
                      &lt;ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /&gt;
                  &lt;/ds:Transforms&gt;
                  &lt;ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /&gt;
                  &lt;ds:DigestValue&gt;nCrBE9jowt9QAOk5ipw1SFnb248=&lt;/ds:DigestValue&gt;
              &lt;/ds:Reference&gt;
          &lt;/ds:SignedInfo&gt;
          &lt;ds:SignatureValue&gt;lwSHBmy4Hqt3XjbnPni6PePFFCn9hUJb7K4jh3xAyUum+y59TUYftphi00lFhnFZXsV5Tj75zLru3JX1jt7bdT73wsYS6ccNcyOvZpJvNiqbBeUmydK45DBrzIVxDA9CWS94+PTH4rrWT5+OEWURBxwhv9BiKiFrLb60YIp6Q3o=&lt;/ds:SignatureValue&gt;
          &lt;ds:KeyInfo&gt;
              &lt;ds:X509Data&gt;
                  &lt;ds:X509Certificate&gt;MIICmzCCAgSgAwIBAgIGAT1+4eJ9MA0GCSqGSIb3DQEBBQUAMIGQMQswCQYDVQQGEwJVUzETMBEG
  A1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsGA1UECgwET2t0YTEU
  MBIGA1UECwwLU1NPUHJvdmlkZXIxETAPBgNVBAMMCHdhdGNoZG94MRwwGgYJKoZIhvcNAQkBFg1p
  bmZvQG9rdGEuY29tMB4XDTEzMDMxODE5MDE0NVoXDTQzMDMxODE5MDI0NVowgZAxCzAJBgNVBAYT
  AlVTMRMwEQYDVQQIDApDYWxpZm9ybmlhMRYwFAYDVQQHDA1TYW4gRnJhbmNpc2NvMQ0wCwYDVQQK
  DARPa3RhMRQwEgYDVQQLDAtTU09Qcm92aWRlcjERMA8GA1UEAwwId2F0Y2hkb3gxHDAaBgkqhkiG
  9w0BCQEWDWluZm9Ab2t0YS5jb20wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAL/raSnE0EXQ
  mPgkSwyv8HIDPpmvU6prdySiWJSB3YztIC29VuneZbT0dFAOjAy6e/3NN7HjvBQU83YjhgBA43+U
  f/7kwC2V8e5qi92J/pTrAWPB/UmTbCEVoCkR4BxSXr4bJ3dhk6eIPDGgOiuWjNCMTXoYX+aS1tsA
  JDx0bXf5AgMBAAEwDQYJKoZIhvcNAQEFBQADgYEAfiBOI+/mpP52Qsg6Ea1jVN/mGm4snvKl6Nlh
  5sYGhGw5zXBVDU4pI9ulm/8QZsCAlYZXltZ+eif7CRzy2VZvDVMGH3g69AD2xHveYr8UNYSjnLyB
  ZPpVJVOysH7UgtBqNcHm0l00g4uUV2d52WcDiz85q/KjTBB9OjRdGVhkcow=&lt;/ds:X509Certificate&gt;
              &lt;/ds:X509Data&gt;
          &lt;/ds:KeyInfo&gt;
      &lt;/ds:Signature&gt;
      &lt;saml2p:Status xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol"&gt;
          &lt;saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /&gt;
      &lt;/saml2p:Status&gt;
      &lt;saml2:Assertion xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"
                       ID="id14123496090473949894445897"
                       IssueInstant="2013-04-18T08:51:49.819Z"
                       Version="2.0"
                       &gt;
          &lt;saml2:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity"
                        xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"
                        &gt;http://www.okta.com/k3gvyf0mGFVVCVQBYTTA&lt;/saml2:Issuer&gt;
          &lt;ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"&gt;
              &lt;ds:SignedInfo&gt;
                  &lt;ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /&gt;
                  &lt;ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /&gt;
                  &lt;ds:Reference URI="#id14123496090473949894445897"&gt;
                      &lt;ds:Transforms&gt;
                          &lt;ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /&gt;
                          &lt;ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /&gt;
                      &lt;/ds:Transforms&gt;
                      &lt;ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /&gt;
                      &lt;ds:DigestValue&gt;D/wZzyBDL0RXwrf7d44mvuysYz0=&lt;/ds:DigestValue&gt;
                  &lt;/ds:Reference&gt;
              &lt;/ds:SignedInfo&gt;
              &lt;ds:SignatureValue&gt;DCrm/mkLiVsD8dAc4puY/L3GR1bxtDBn6+sTifLgxDGokFbS4PShjA3Ak6mTW1dM48TwXi1oB9Pz++iOP4w6ZVeBj9bWIPJaCATjWn26xBlt3GHaPjiOpUdvG5YwwqCMUlQ1+M0RhJDlkChfZbjPIKXibcP8TBIsj2sekr5sQSI=&lt;/ds:SignatureValue&gt;
              &lt;ds:KeyInfo&gt;
                  &lt;ds:X509Data&gt;
                      &lt;ds:X509Certificate&gt;MIICmzCCAgSgAwIBAgIGAT1+4eJ9MA0GCSqGSIb3DQEBBQUAMIGQMQswCQYDVQQGEwJVUzETMBEG
  A1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsGA1UECgwET2t0YTEU
  MBIGA1UECwwLU1NPUHJvdmlkZXIxETAPBgNVBAMMCHdhdGNoZG94MRwwGgYJKoZIhvcNAQkBFg1p
  bmZvQG9rdGEuY29tMB4XDTEzMDMxODE5MDE0NVoXDTQzMDMxODE5MDI0NVowgZAxCzAJBgNVBAYT
  AlVTMRMwEQYDVQQIDApDYWxpZm9ybmlhMRYwFAYDVQQHDA1TYW4gRnJhbmNpc2NvMQ0wCwYDVQQK
  DARPa3RhMRQwEgYDVQQLDAtTU09Qcm92aWRlcjERMA8GA1UEAwwId2F0Y2hkb3gxHDAaBgkqhkiG
  9w0BCQEWDWluZm9Ab2t0YS5jb20wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAL/raSnE0EXQ
  mPgkSwyv8HIDPpmvU6prdySiWJSB3YztIC29VuneZbT0dFAOjAy6e/3NN7HjvBQU83YjhgBA43+U
  f/7kwC2V8e5qi92J/pTrAWPB/UmTbCEVoCkR4BxSXr4bJ3dhk6eIPDGgOiuWjNCMTXoYX+aS1tsA
  JDx0bXf5AgMBAAEwDQYJKoZIhvcNAQEFBQADgYEAfiBOI+/mpP52Qsg6Ea1jVN/mGm4snvKl6Nlh
  5sYGhGw5zXBVDU4pI9ulm/8QZsCAlYZXltZ+eif7CRzy2VZvDVMGH3g69AD2xHveYr8UNYSjnLyB
  ZPpVJVOysH7UgtBqNcHm0l00g4uUV2d52WcDiz85q/KjTBB9OjRdGVhkcow=&lt;/ds:X509Certificate&gt;
                  &lt;/ds:X509Data&gt;
              &lt;/ds:KeyInfo&gt;
          &lt;/ds:Signature&gt;
          &lt;saml2:Subject xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"&gt;
              &lt;saml2:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"&gt;OhadR@watchdox.com&lt;/saml2:NameID&gt;
              &lt;saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"&gt;
                  &lt;saml2:SubjectConfirmationData InResponseTo="a32a5d9jfge33c9b46gdaddid8gd41b"
                                                 NotOnOrAfter="2013-04-18T08:56:49.819Z"
                                                 Recipient="http://srv101.watchdox.net/spring-security-saml2-sample/saml/SSO/alias/defaultAlias"
                                                 /&gt;
              &lt;/saml2:SubjectConfirmation&gt;
          &lt;/saml2:Subject&gt;
          &lt;saml2:Conditions NotBefore="2013-04-18T08:46:49.819Z"
                            NotOnOrAfter="2013-04-18T08:56:49.819Z"
                            xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"
                            &gt;
              &lt;saml2:AudienceRestriction&gt;
                  &lt;saml2:Audience&gt;com.watchdox.ohad&lt;/saml2:Audience&gt;
              &lt;/saml2:AudienceRestriction&gt;
          &lt;/saml2:Conditions&gt;
          &lt;saml2:AuthnStatement AuthnInstant="2013-04-18T08:51:49.819Z"
                                SessionIndex="a32a5d9jfge33c9b46gdaddid8gd41b"
                                xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"
                                &gt;
              &lt;saml2:AuthnContext&gt;
                  &lt;saml2:AuthnContextClassRef&gt;urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport&lt;/saml2:AuthnContextClassRef&gt;
              &lt;/saml2:AuthnContext&gt;
          &lt;/saml2:AuthnStatement&gt;
      &lt;/saml2:Assertion&gt;
  &lt;/saml2p:Response&gt;
  </code></pre>
  
  <p>Thanks for any answer!</p>