AWX SAML authentication with Okta - RelayState

[Denney-tech (Caleb Denney)]

Thank you for providing more context of what you have done. I realize that I have been focusing on the slash a little, but that is the only information/reference we had to go on that was confusing.

Your SAML config for AWX appears to be missing some required fields, as mentioned by @jbird. @jdp11d ended up adding additional fields in his response.

@jbird

{
  “okta”: {
    “attr_user_permanent_id”: “urn:oid:1.3.6.1.4.1.5555.610.2.2.1.11”,
    “attr_username”: “urn:oid:1.3.6.1.4.1.5555.610.2.2.1.11”,
    “entity_id”: “”, 
    “url”: “”,
    “x509cert”: “”
    }
}

@jdp11d

{
  "okta": {
    "attr_user_permanent_id": "name_id",
    "attr_first_name": "User.FirstName",
    "attr_last_name": "User.LastName",
    "attr_username": "User.email",
    "attr_email": "User.email",
    "entity_id": "http://www.okta.com/<ID>",
    "url": "https://okta.com/app/<NAME>/<ID>/sso/saml",
    "x509cert": "<CERT FROM OKTA>"
  }
}

@trippinnik

{
  "okta": {
    "entity_id": "http://okta-entity-id/",
    "url": "https://okta-url/sso/saml/",
    "x509cert": "-----BEGINCERTIFICATE-----cert-----ENDCERTIFICATE-----"
  }
}

Your issue may just be missing fields, but you also have trailing slashes where @jdp11d does not (entity_id and url). That doesn’t mean yours or his are incorrect, just that I have no confidence in which is correct or if it even matters here on the AWX side.

Edit: And I think the “error on Okta’s side” that his “Okta admin” fixed, was simply the URL/URI settings in the following sample:

Platform: Web
Single Sign On Method: SAML 2.0
Application Name: Company-Ansible-Tower
Single sign on URL: https://ansibletower.company.com/sso/complete/saml/
Audience URI (SP Entity ID): https://ansibletower.company.com

If that’s not the case, then we need @jdp11d to clarify.

And if adding the missing fields to your AWX config is not enough to resolve the issue, then I don’t have any further suggestions that I can think of to help.