# AWX SAML authentication with Okta - RelayState

**URL:** <https://forum.ansible.com/t/awx-saml-authentication-with-okta-relaystate/7480>\
**Category:** Get Help\
**Tags:** awx\
**Created:** [July 25, 2024, 2:48pm UTC](https://forum.ansible.com/t/awx-saml-authentication-with-okta-relaystate/7480 "2024-07-25T14:48:20Z")\
**Posts on this page:** 1\
**Showing post:** 13

<div class="post-metadata">

**Author:** ![Denney-tech](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/denney-tech/32/1556_2.png) [@Denney-tech](https://forum.ansible.com/u/Denney-tech)\
**Post date:** [August 1, 2024, 5:21pm UTC](https://forum.ansible.com/t/awx-saml-authentication-with-okta-relaystate/7480/13 "2024-08-01T17:21:24Z")

</div>

Thank you for providing more context of what you have done. I realize that I have been focusing on the slash a little, but that is the only information/reference we had to go on that was confusing.

Your SAML config for AWX appears to be missing some required fields, as mentioned by @jbird. @jdp11d ended up adding additional fields in his response.

> [@Okta saml auth error social 'RelayState'](http://forum.ansible.com/t/okta-saml-auth-error-social-relaystate/4914/3):
>
> ```json
> {
> “okta”: {
> “attr_user_permanent_id”: “urn:oid:1.3.6.1.4.1.5555.610.2.2.1.11”,
> “attr_username”: “urn:oid:1.3.6.1.4.1.5555.610.2.2.1.11”,
> “entity_id”: “”, 
> “url”: “”,
> “x509cert”: “”
> }
> }
> 
> ```

> [@Okta saml auth error social 'RelayState'](http://forum.ansible.com/t/okta-saml-auth-error-social-relaystate/4914/4):
>
> ```auto
> {
> "okta": {
> "attr_user_permanent_id": "name_id",
> "attr_first_name": "User.FirstName",
> "attr_last_name": "User.LastName",
> "attr_username": "User.email",
> "attr_email": "User.email",
> "entity_id": "http://www.okta.com/<ID>",
> "url": "https://okta.com/app/<NAME>/<ID>/sso/saml",
> "x509cert": "<CERT FROM OKTA>"
> }
> }
> 
> ```

> [@trippinnik](#):
>
> ```auto
> {
> "okta": {
> "entity_id": "http://okta-entity-id/",
> "url": "https://okta-url/sso/saml/",
> "x509cert": "-----BEGINCERTIFICATE-----cert-----ENDCERTIFICATE-----"
> }
> }
> 
> ```

Your issue may just be missing fields, but you also have trailing slashes where @jdp11d does not (`entity_id` and `url`). That doesn’t mean yours or his are incorrect, just that I have no confidence in which is correct or if it even matters here on the AWX side.

Edit: And I think the “error on Okta’s side” that his “Okta admin” fixed, was simply the URL/URI settings in the following sample:

```yaml
Platform: Web
Single Sign On Method: SAML 2.0
Application Name: Company-Ansible-Tower
Single sign on URL: https://ansibletower.company.com/sso/complete/saml/
Audience URI (SP Entity ID): https://ansibletower.company.com

```

If that’s not the case, then we need @jdp11d to clarify.

And if adding the missing fields to your AWX config is not enough to resolve the issue, then I don’t have any further suggestions that I can think of to help.

---

_[View the full topic](https://forum.ansible.com/t/awx-saml-authentication-with-okta-relaystate/7480)._