# AWX integration with Okta **URL:** \ **Category:** AWX Project\ **Tags:** awx\ **Created:** [February 4, 2021, 5:28pm UTC](https://forum.ansible.com/t/awx-integration-with-okta/34571 "2021-02-04T17:28:49Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Angel\_Rengifo\_Cancin](https://avatars.discourse-cdn.com/v4/letter/a/9e8a1a/32.png) [@Angel\_Rengifo\_Cancin](https://forum.ansible.com/u/Angel_Rengifo_Cancin)\ **Post date:** [February 4, 2021, 5:28pm UTC](https://forum.ansible.com/t/awx-integration-with-okta/34571/1 "2021-02-04T17:28:49Z")
Hi guys: Does anybody know how to properly configure AWX SAML authentication with Okta? I’m struggling with this matter because AWX (v15.0.1) shows me this in log file: “ERROR social Authentication failed: SAML login failed: [‘invalid\_response’] (There is no AttributeStatement on the Response).” or this: “WARNING awx.sso.backends Could not map user detail ‘first\_name’ from SAML attribute ‘FirstName’; update SOCIAL\_AUTH\_SAML\_ENABLED\_IDPS[‘okta’][‘attr\_first\_name’] with the correct SAML attribute” I’m not pretty sure how can I debug this. If anybody has some ideas, please help. Thanks in advance ---
**Author:** ![Marek\_Z](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/marek_z/32/7929_2.png) [@Marek\_Z](https://forum.ansible.com/u/Marek_Z)\ **Post date:** [April 6, 2021, 3:33pm UTC](https://forum.ansible.com/t/awx-integration-with-okta/34571/2 "2021-04-06T15:33:34Z")
Hi. Try following this article: [https://access.redhat.com/solutions/4618191](https://access.redhat.com/solutions/4618191) (how to get access: [https://old.reddit.com/r/sysadmin/comments/5136ty/anyone\_has\_access\_to\_redhats\_knowledgebase/d78xsj2/](https://old.reddit.com/r/sysadmin/comments/5136ty/anyone_has_access_to_redhats_knowledgebase/d78xsj2/) ) As for that error: [https://help.ftrack.com/en/articles/1430063-single-sign-on-via-saml](https://help.ftrack.com/en/articles/1430063-single-sign-on-via-saml) Under the advanced settings field, add the following: {“security”: { “wantAttributeStatement”: false }} Not sure if it’ll be enough - still struggling with it myself. –Marek ---
**Author:** ![Angel\_Rengifo\_Cancin](https://avatars.discourse-cdn.com/v4/letter/a/9e8a1a/32.png) [@Angel\_Rengifo\_Cancin](https://forum.ansible.com/u/Angel_Rengifo_Cancin)\ **Post date:** [April 6, 2021, 3:39pm UTC](https://forum.ansible.com/t/awx-integration-with-okta/34571/3 "2021-04-06T15:39:38Z")
Thanks a lot for your response. ---
**Author:** ![Daniel2](https://avatars.discourse-cdn.com/v4/letter/d/b2d939/32.png) [@Daniel2](https://forum.ansible.com/u/Daniel2)\ **Post date:** [April 6, 2021, 9:01pm UTC](https://forum.ansible.com/t/awx-integration-with-okta/34571/4 "2021-04-06T21:01:11Z")
I would really like to see what you did… I have tried various ways and times to configure it. Thank you Daniel ---
**Author:** ![Angel\_Rengifo\_Cancin](https://avatars.discourse-cdn.com/v4/letter/a/9e8a1a/32.png) [@Angel\_Rengifo\_Cancin](https://forum.ansible.com/u/Angel_Rengifo_Cancin)\ **Post date:** [April 7, 2021, 11:39am UTC](https://forum.ansible.com/t/awx-integration-with-okta/34571/5 "2021-04-07T11:39:29Z")
Hi > I would really like to see what you did… I have tried various ways and times to configure it. These are my working settings: - SAML SERVICE PROVIDER PUBLIC CERTIFICATE: I’ve pasted here the PEM certificate attached to the load balancer in front of AWX. - SAML SERVICE PROVIDER PRIVATE KEY: I was never sure how this works or how it was used. As I didn’t have access to the private key of the certificate -because I was using a certificate from ACM- I’ve just pasted any private key created with openssl. - SAML SERVICE PROVIDER ORGANIZATION INFO: { “en-US”: { “name”: “any-org-name”, “url”: “[https://awx.at.mydomain.com](https://awx.at.mydomain.com)”, “displayname”: “Whatever you want” } } - SAML SERVICE PROVIDER TECHNICAL CONTACT: { “emailAddress”: “[technician@mydomain.com](mailto:technician@mydomain.com)”, “givenName”: “any-name” } - SAML SERVICE PROVIDER SUPPORT CONTACT: { “emailAddress”: “[it-support@mydomain.com](mailto:it-support@mydomain.com)”, “givenName”: “any-name” } - SAML ENABLED IDENTITY PROVIDERS { “my-okta-idp-name”: { “entity\_id”: “[http://www.okta.com/A-VALID-ENTITY-ID](http://www.okta.com/A-VALID-ENTITY-ID)”, “attr\_username”: “userName”, “attr\_first\_name”: “firstName”, “attr\_user\_permanent\_id”: “name\_id”, “url”: “[https://YOUR-ORG-OKTA-NAME.okta.com/app/OKTA-APP-NAME/A-VALID-ENTITY-ID/sso/saml](https://YOUR-ORG-OKTA-NAME.okta.com/app/OKTA-APP-NAME/A-VALID-ENTITY-ID/sso/saml)”, “attr\_last\_name”: “lastName”, “attr\_email”: “Email”, “x509cert”: “OKTAAPP-PEM-CERTIFICATE-CONTENT-IN-ONE-SINGLE-LINE-WITHOUT-SPACES” } } - An Entity ID is usually an alphanumeric random string generated for your Okta App - SAML ORGANIZATION MAP. This might be different depending on your needs { “MY-AWX-ORG-NAME”: { “admins”: true, “users”: true } } - All other SAML settings are set to their default values Optionally, under “Settings → System” for the section “LOGIN REDIRECT OVERRIDE URL” I’ve set “/sso/login/saml/?idp=my-okta-idp-name” as value Hope it helps ---
**Author:** ![Daniel2](https://avatars.discourse-cdn.com/v4/letter/d/b2d939/32.png) [@Daniel2](https://forum.ansible.com/u/Daniel2)\ **Post date:** [April 15, 2021, 9:17pm UTC](https://forum.ansible.com/t/awx-integration-with-okta/34571/6 "2021-04-15T21:17:38Z")
Thank you. I will look into this and see what I can do… ---
**Author:** ![Daniel2](https://avatars.discourse-cdn.com/v4/letter/d/b2d939/32.png) [@Daniel2](https://forum.ansible.com/u/Daniel2)\ **Post date:** [April 15, 2021, 9:20pm UTC](https://forum.ansible.com/t/awx-integration-with-okta/34571/7 "2021-04-15T21:20:04Z")
Was this in a specific file? I have been trying to configure from the AWX Gui.