# AWX SAML authentication with Okta - RelayState

**URL:** <https://forum.ansible.com/t/awx-saml-authentication-with-okta-relaystate/7480>\
**Category:** Get Help\
**Tags:** awx\
**Created:** [July 25, 2024, 2:48pm UTC](https://forum.ansible.com/t/awx-saml-authentication-with-okta-relaystate/7480 "2024-07-25T14:48:20Z")\
**Posts on this page:** 1\
**Showing post:** 12

<div class="post-metadata">

**Author:** ![trippinnik](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/trippinnik/32/4308_2.png) [@trippinnik](https://forum.ansible.com/u/trippinnik)\
**Post date:** [August 1, 2024, 4:59pm UTC](https://forum.ansible.com/t/awx-saml-authentication-with-okta-relaystate/7480/12 "2024-08-01T16:59:16Z")

</div>

I think you are hung up on trailing ‘/’ that is mentioned, but I think you are missing the past perfect tense. The trailing slash issue was resolved AND then Okta admin did something

> [@Okta saml auth error social 'RelayState'](http://forum.ansible.com/t/okta-saml-auth-error-social-relaystate/4914/4):
>
> Hi Jeff! Thank you for your reply. Sorry for late reply I was out on a work trip. I was able to follow the steps you suggested. by adding the following to my awx config. --- apiVersion: awx.ansible.com/v1beta1 kind: AWX metadata: name: awx-mgmt spec: secret\_key\_secret: awx-mgmt-secret-key extra\_settings: - setting: USE\_X\_FORWARDED\_HOST value: "True" --- apiVersion: v1 kind: Secret metadata: name: awx-mgmt-secret-key namespace: awx stringData: secret\_key: --- apiVersion: …

```auto
<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" cacheDuration="P10D" entityID="https://my-awx-url">
<md:SPSSODescriptor AuthnRequestsSigned="false" WantAssertionsSigned="false" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
<md:KeyDescriptor use="signing">
<ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:X509Data>
<ds:X509Certificate>cert</ds:X509Certificate>
</ds:X509Data>
</ds:KeyInfo>
</md:KeyDescriptor>
<md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</md:NameIDFormat>
<md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://my-awx-url/sso/complete/saml/" index="1"/>
</md:SPSSODescriptor>
<md:Organization>
<md:OrganizationName xml:lang="en-US">AWX</md:OrganizationName>
<md:OrganizationDisplayName xml:lang="en-US">AWX</md:OrganizationDisplayName>
<md:OrganizationURL xml:lang="en-US">my-awx-url</md:OrganizationURL>
</md:Organization>
<md:ContactPerson contactType="technical">
<md:GivenName>name</md:GivenName>
<md:EmailAddress>email address</md:EmailAddress>
</md:ContactPerson>
<md:ContactPerson contactType="support">
<md:GivenName>name</md:GivenName>
<md:EmailAddress>email address</md:EmailAddress>
</md:ContactPerson>
</md:EntityDescriptor>

```

for SAML Enabled Identity Providers

```auto
{
  "okta": {
    "entity_id": "http://okta-entity-id/",
    "url": "https://okta-url/sso/saml/",
    "x509cert": "-----BEGINCERTIFICATE-----cert-----ENDCERTIFICATE-----"
  }
}

```

What else would you find useful?

---

_[View the full topic](https://forum.ansible.com/t/awx-saml-authentication-with-okta-relaystate/7480)._