# SAML **URL:** https://devforum.okta.com/c/questions/saml/20.md [Latest](https://devforum.okta.com/latest.md) · [Categories](https://devforum.okta.com/categories.md) · [Tags](https://devforum.okta.com/tags.md) --- ## [API to Retrieve SAML Application Encryption Certificate Expiration Date](https://devforum.okta.com/t/api-to-retrieve-saml-application-encryption-certificate-expiration-date/35414)
**Author:** [@kirann9679](https://devforum.okta.com/u/kirann9679)\ **Replies:** 1\ **Last updated:** [August 7, 2026, 5:48am UTC](https://devforum.okta.com/t/api-to-retrieve-saml-application-encryption-certificate-expiration-date/35414 "2026-08-07T05:48:08Z")
Hello Okta Team, I was looking for an Okta API to retrieve the expiration date of the application certificate used by an Okta SAML application to encrypt assertions. I was able to retrieve the certificate using the Ret… --- ## [Locked out of only Super Admin account on Integrator Free Plan - non-admin users can still sign in](https://devforum.okta.com/t/locked-out-of-only-super-admin-account-on-integrator-free-plan-non-admin-users-can-still-sign-in/35398)
**Author:** [@clatty](https://devforum.okta.com/u/clatty)\ **Replies:** 1\ **Last updated:** [July 31, 2026, 4:28am UTC](https://devforum.okta.com/t/locked-out-of-only-super-admin-account-on-integrator-free-plan-non-admin-users-can-still-sign-in/35398 "2026-07-31T04:28:30Z")
Hi everyone, I’m hoping someone can point me in the right direction. I’m using an Okta Integrator Free Plan tenant: Tenant: https://integrator-#######.okta.com My only administrator account is my own Yesterday every… --- ## [P-initiated SAML resolves to Okta Dashboard instead of the relying party (AWS IAM Identity Center) — no SAMLResponse emitted; IdP-initiated works](https://devforum.okta.com/t/p-initiated-saml-resolves-to-okta-dashboard-instead-of-the-relying-party-aws-iam-identity-center-no-samlresponse-emitted-idp-initiated-works/35324)
**Author:** [@ZLo90](https://devforum.okta.com/u/ZLo90)\ **Replies:** 1\ **Last updated:** [June 26, 2026, 7:04am UTC](https://devforum.okta.com/t/p-initiated-saml-resolves-to-okta-dashboard-instead-of-the-relying-party-aws-iam-identity-center-no-samlresponse-emitted-idp-initiated-works/35324 "2026-06-26T07:04:36Z")
I’m federating Okta to AWS IAM Identity Center via SAML. IdP-initiated sign-in (clicking the app tile) works perfectly. SP-initiated sign-in (user starts at the AWS access portal; AWS sends an AuthnRequest to Okta) authe… --- ## [JDBC / ODBC help](https://devforum.okta.com/t/jdbc-odbc-help/35226)
**Author:** [@Eljeffe](https://devforum.okta.com/u/Eljeffe)\ **Replies:** 1\ **Last updated:** [April 14, 2026, 5:07pm UTC](https://devforum.okta.com/t/jdbc-odbc-help/35226 "2026-04-14T17:07:24Z")
Hoping someone here can help :folded\_hands: guide me. I’m trying to make a JDBC connection to AWS Athena via Okta. I can access Athena via the Okta Web App. I’m getting conflicting information on what is needed and am… --- ## [Unable to SAML2 log out from Okta](https://devforum.okta.com/t/unable-to-saml2-log-out-from-okta/35077)
**Author:** [@theo.depinho.etu](https://devforum.okta.com/u/theo.depinho.etu)\ **Replies:** 2\ **Last updated:** [March 7, 2026, 9:43am UTC](https://devforum.okta.com/t/unable-to-saml2-log-out-from-okta/35077 "2026-03-07T09:43:23Z")
Hello :slight\_smile: I’m trying to enable logout on my Okta application. The authentication protocol is SAML2 and the app used Java Spring and runs on localhost:8080. The current behavior is the following : when access… --- ## [Problem with to config GitHub Enterprise Managed User](https://devforum.okta.com/t/problem-with-to-config-github-enterprise-managed-user/35030)
**Author:** [@renattomachado](https://devforum.okta.com/u/renattomachado)\ **Replies:** 4\ **Last updated:** [February 9, 2026, 6:22pm UTC](https://devforum.okta.com/t/problem-with-to-config-github-enterprise-managed-user/35030 "2026-02-09T18:22:12Z")
GitHub Enterprise Managed User shows: There are no sign-on modes available for this application. I’ve install the app integration from this url: GitHub Enterprise Managed User | Okta How solve that? --- ## [Set NameID to EmailAddress while logging in with Unique ID](https://devforum.okta.com/t/set-nameid-to-emailaddress-while-logging-in-with-unique-id/34711)
**Author:** [@hkim](https://devforum.okta.com/u/hkim)\ **Replies:** 0\ **Last updated:** [January 8, 2026, 5:38pm UTC](https://devforum.okta.com/t/set-nameid-to-emailaddress-while-logging-in-with-unique-id/34711 "2026-01-08T17:38:45Z")
Our system requires the NameID attribute to be populated with the user’s email address. However, users must authenticate using their Unique ID. Question: How can we configure the Okta to use the Unique ID for login but … --- ## [Generic SAML 2.0 app cannot emit AWS Role attributes from group profile attributes (works in AWS Federation app)](https://devforum.okta.com/t/generic-saml-2-0-app-cannot-emit-aws-role-attributes-from-group-profile-attributes-works-in-aws-federation-app/34697)
**Author:** [@yogesh.shivnekar](https://devforum.okta.com/u/yogesh.shivnekar)\ **Replies:** 0\ **Last updated:** [January 2, 2026, 9:48am UTC](https://devforum.okta.com/t/generic-saml-2-0-app-cannot-emit-aws-role-attributes-from-group-profile-attributes-works-in-aws-federation-app/34697 "2026-01-02T09:48:11Z")
Hi Okta Team, We would like to explain our full use case and request clarification on a limitation we are encountering when using a Generic SAML 2.0 application with AWS. Background We federate Okta → AWS using SAML … --- ## [Can Okta bridge IdP‑initiated SAML from Google to SP‑initiated OIDC for Power Pages?](https://devforum.okta.com/t/can-okta-bridge-idp-initiated-saml-from-google-to-sp-initiated-oidc-for-power-pages/34638)
**Author:** [@Malav](https://devforum.okta.com/u/Malav)\ **Replies:** 0\ **Last updated:** [December 1, 2025, 3:48pm UTC](https://devforum.okta.com/t/can-okta-bridge-idp-initiated-saml-from-google-to-sp-initiated-oidc-for-power-pages/34638 "2025-12-01T15:48:27Z")
Hi All, I need help to set up authentication in Power Pages with Okta. This is the first time I am using it. I have gone through the documentation but could not find details around the solution I am looking for. Below i… --- ## [SAML2 → OAuth Token Exchange Failing: Assertion Invalid (SAML App + OIDC App in Same Okta Org)](https://devforum.okta.com/t/saml2-oauth-token-exchange-failing-assertion-invalid-saml-app-oidc-app-in-same-okta-org/34635)
**Author:** [@1705031](https://devforum.okta.com/u/1705031)\ **Replies:** 0\ **Last updated:** [November 28, 2025, 4:37am UTC](https://devforum.okta.com/t/saml2-oauth-token-exchange-failing-assertion-invalid-saml-app-oidc-app-in-same-okta-org/34635 "2025-11-28T04:37:42Z")
Hello Team, I am trying to implement an Okta-to-Okta token exchange using the SAML2 assertion grant. My setup is fully within the same Okta org, and I am using: A SAML 2.0 Application for user authentication An O… --- ## [Okta SAML2 Integration](https://devforum.okta.com/t/okta-saml2-integration/34571)
**Author:** [@monk](https://devforum.okta.com/u/monk)\ **Replies:** 2\ **Last updated:** [November 9, 2025, 6:38am UTC](https://devforum.okta.com/t/okta-saml2-integration/34571 "2025-11-09T06:38:04Z")
Hi I am trying to setup Okta integration with my front end app running in my localhost. And using service provider as backend service to handle SAML responses. I am stuck at setting up config at Okta side and hav… --- ## [Okta SAML2 Metadata is Wrong](https://devforum.okta.com/t/okta-saml2-metadata-is-wrong/34552)
**Author:** [@418422bb](https://devforum.okta.com/u/418422bb)\ **Replies:** 2\ **Last updated:** [November 3, 2025, 4:48pm UTC](https://devforum.okta.com/t/okta-saml2-metadata-is-wrong/34552 "2025-11-03T16:48:08Z")
When creating a plain SAML2 application in Okta, it gives you the option/a link to the metadata URL. For example: https://dev-68712571.okta.com/app/exkrbaovxrb4x9eX85d7/sso/saml/metadata However, that XML does not c… --- ## [Okta SLO clarification](https://devforum.okta.com/t/okta-slo-clarification/34535)
**Author:** [@hbyoon97](https://devforum.okta.com/u/hbyoon97)\ **Replies:** 3\ **Last updated:** [October 27, 2025, 2:30pm UTC](https://devforum.okta.com/t/okta-slo-clarification/34535 "2025-10-27T14:30:52Z")
Hi support, Based on this comment from Testing/Understanding SLO with OKTA - #17 by ramgan , it seems you guys have confirmed that Single Logout feature is designed to work only for applications within the same browser … --- ## [Testing/Understanding SLO with OKTA](https://devforum.okta.com/t/testing-understanding-slo-with-okta/34069)
**Author:** [@nik.tik](https://devforum.okta.com/u/nik.tik)\ **Replies:** 17\ **Last updated:** [October 10, 2025, 9:17am UTC](https://devforum.okta.com/t/testing-understanding-slo-with-okta/34069 "2025-10-10T09:17:45Z")
Hello forum. I have some problems with understanding/testing Single Logout with OKTA. According to the section 3.7 of the SAML specs - If there are multiple participants (other applications) in a session besides your a… --- ## [Clearing user sessions as an Admin and SLO](https://devforum.okta.com/t/clearing-user-sessions-as-an-admin-and-slo/34297)
**Author:** [@nik.tik](https://devforum.okta.com/u/nik.tik)\ **Replies:** 2\ **Last updated:** [September 24, 2025, 11:18am UTC](https://devforum.okta.com/t/clearing-user-sessions-as-an-admin-and-slo/34297 "2025-09-24T11:18:42Z")
Hi all. There is an option for an admin to ‘Clear user sessions’ from the user screen. Is it possible for Okta to send a Single Logout (SLO) request to those sessions? --- ## [Okta start Oauth when Posting SAML to it](https://devforum.okta.com/t/okta-start-oauth-when-posting-saml-to-it/34271)
**Author:** [@yan.zhou](https://devforum.okta.com/u/yan.zhou)\ **Replies:** 1\ **Last updated:** [September 12, 2025, 11:22pm UTC](https://devforum.okta.com/t/okta-start-oauth-when-posting-saml-to-it/34271 "2025-09-12T23:22:51Z")
Hello, this has always worked for me in the past, after a couple months of inactivity, I created a new Okta admin account and created SAML 2.0 app integration. Okta is the IdP, with a Spring Boot App as client. This S… --- ## [Does OKTA supports backchannel binding for SLO?](https://devforum.okta.com/t/does-okta-supports-backchannel-binding-for-slo/34296)
**Author:** [@nik.tik](https://devforum.okta.com/u/nik.tik)\ **Replies:** 0\ **Last updated:** [September 9, 2025, 1:33pm UTC](https://devforum.okta.com/t/does-okta-supports-backchannel-binding-for-slo/34296 "2025-09-09T13:33:03Z")
Hi all. We are trying to set up the Single Logout (SLO) flow for our application using Okta. During this process, we discovered that to enable SLO, the ‘Front-channel Single Logout’ and ‘Front-channel Single Logout for … --- ## [Changing the SAML NameID to a unique user ID](https://devforum.okta.com/t/changing-the-saml-nameid-to-a-unique-user-id/34080)
**Author:** [@matteodmw](https://devforum.okta.com/u/matteodmw)\ **Replies:** 2\ **Last updated:** [August 7, 2025, 7:10am UTC](https://devforum.okta.com/t/changing-the-saml-nameid-to-a-unique-user-id/34080 "2025-08-07T07:10:16Z")
Hello, I’m trying to have the SAML response contain a unique user ID as the NameID. This is because the Okta username can change with time and that makes it impossible for the service provider to match the existing user… --- ## [Okta initiated SAML logout, try 2](https://devforum.okta.com/t/okta-initiated-saml-logout-try-2/34052)
**Author:** [@nik.tik](https://devforum.okta.com/u/nik.tik)\ **Replies:** 5\ **Last updated:** [August 4, 2025, 2:35pm UTC](https://devforum.okta.com/t/okta-initiated-saml-logout-try-2/34052 "2025-08-04T14:35:17Z")
Is there a way to start IdP initiated logout from Okta side? Do I need to turned on “Front-channel Single Logout” and “Front-channel Single Logout for IdPs” for that? --- ## [Integrate SAML in ASP.net Webforms](https://devforum.okta.com/t/integrate-saml-in-asp-net-webforms/26324)
**Author:** [@Ajayshanbhag](https://devforum.okta.com/u/Ajayshanbhag)\ **Replies:** 9\ **Last updated:** [July 31, 2025, 11:17pm UTC](https://devforum.okta.com/t/integrate-saml-in-asp-net-webforms/26324 "2025-07-31T23:17:27Z")
How to integrate the SAML in ASP.net Webforms. can you please help me how to do it using sustainsys.saml2 or if you have any other method it will also work --- ## [SAML assertion section not visible between okta to okta setup](https://devforum.okta.com/t/saml-assertion-section-not-visible-between-okta-to-okta-setup/33966)
**Author:** [@akash.singhal](https://devforum.okta.com/u/akash.singhal)\ **Replies:** 3\ **Last updated:** [July 23, 2025, 2:12pm UTC](https://devforum.okta.com/t/saml-assertion-section-not-visible-between-okta-to-okta-setup/33966 "2025-07-23T14:12:26Z")
We’re having OKTA to OKTA setup for SP and IDP, where upon authentication no SAML assertion is seen in the response, When I click on preview assertion everything shows fine on the OKTA IDP side and upon authentication al… --- ## [JIT behavior in preview Vs Production version](https://devforum.okta.com/t/jit-behavior-in-preview-vs-production-version/33564)
**Author:** [@manandan](https://devforum.okta.com/u/manandan)\ **Replies:** 0\ **Last updated:** [June 24, 2025, 7:24am UTC](https://devforum.okta.com/t/jit-behavior-in-preview-vs-production-version/33564 "2025-06-24T07:24:07Z")
We’ve encountered an issue in our Okta Production org related to JIT provisioning via federated SAML IdPs. Specifically, we’ve noticed that custom user attributes passed in the SAML assertion are not being updated during… --- ## [Invalid Grant for SAML Assertion Flow](https://devforum.okta.com/t/invalid-grant-for-saml-assertion-flow/33409)
**Author:** [@jpsox04](https://devforum.okta.com/u/jpsox04)\ **Replies:** 2\ **Last updated:** [June 18, 2025, 5:39pm UTC](https://devforum.okta.com/t/invalid-grant-for-saml-assertion-flow/33409 "2025-06-18T17:39:22Z")
Hi, I’ve been banging my head against the wall for days on this particular problem! I have followed this guide to the letter. I am able to get a SAML response and what appears to be a valid SAML assertion. I base64url … --- ## [Adding destination url to saml assertion](https://devforum.okta.com/t/adding-destination-url-to-saml-assertion/33178)
**Author:** [@vi009](https://devforum.okta.com/u/vi009)\ **Replies:** 1\ **Last updated:** [June 3, 2025, 7:53am UTC](https://devforum.okta.com/t/adding-destination-url-to-saml-assertion/33178 "2025-06-03T07:53:49Z")
Unable to set destination url in saml response while create a saml 2.0 app --- ## [SAML Login with Okta in python](https://devforum.okta.com/t/saml-login-with-okta-in-python/33041)
**Author:** [@TheScriptGuy](https://devforum.okta.com/u/TheScriptGuy)\ **Replies:** 0\ **Last updated:** [May 2, 2025, 10:06pm UTC](https://devforum.okta.com/t/saml-login-with-okta-in-python/33041 "2025-05-02T22:06:23Z")
Hi, I have a public explicit proxy that redirects to Okta in order to login. I’m trying to figure out a way to use a python script to be able to handle the SAML login and then proceed to request the proxy to browse to a… --- ## [Getting started with Okta/Auth0 to integrate third party IDP in our SaaS](https://devforum.okta.com/t/getting-started-with-okta-auth0-to-integrate-third-party-idp-in-our-saas/32870)
**Author:** [@7hibault](https://devforum.okta.com/u/7hibault)\ **Replies:** 2\ **Last updated:** [April 10, 2025, 8:29am UTC](https://devforum.okta.com/t/getting-started-with-okta-auth0-to-integrate-third-party-idp-in-our-saas/32870 "2025-04-10T08:29:33Z")
Hi all, Our clients are asking us if they can log into our apps using their Okta IDP. They’re asking specifically about SAML integration, but I’m not sure if that’s a requirement. I’ve had an Okta/auth0 representative … --- ## [Okta Redirects to Dashboard Instead of My App (SP) After "Sign in with Google"](https://devforum.okta.com/t/okta-redirects-to-dashboard-instead-of-my-app-sp-after-sign-in-with-google/32848)
**Author:** [@goddiegold](https://devforum.okta.com/u/goddiegold)\ **Replies:** 0\ **Last updated:** [April 7, 2025, 10:18am UTC](https://devforum.okta.com/t/okta-redirects-to-dashboard-instead-of-my-app-sp-after-sign-in-with-google/32848 "2025-04-07T10:18:15Z")
I’m using a custom SAML login flow in my app with passport-saml and MultiSamlStrategy (Node.js/NestJS). Each org can upload its own IdP metadata (Okta, Microsoft, onelogin), and everything works fine — except in one edge… --- ## [Jira Service Online with Okta SAML](https://devforum.okta.com/t/jira-service-online-with-okta-saml/32632)
**Author:** [@julianhaines](https://devforum.okta.com/u/julianhaines)\ **Replies:** 0\ **Last updated:** [March 17, 2025, 10:26am UTC](https://devforum.okta.com/t/jira-service-online-with-okta-saml/32632 "2025-03-17T10:26:43Z")
Hi, I am trying to setup Jira service online with Okta using SAML but having issues, when I try and login to the Jira customer portal I enter my email, click use single sign-on and enter my password but get the message … --- ## [Use SSO for some domains but not others](https://devforum.okta.com/t/use-sso-for-some-domains-but-not-others/32041)
**Author:** [@cfs](https://devforum.okta.com/u/cfs)\ **Replies:** 0\ **Last updated:** [February 18, 2025, 7:19pm UTC](https://devforum.okta.com/t/use-sso-for-some-domains-but-not-others/32041 "2025-02-18T19:19:21Z")
I’m starting to integrate Okta with a Gerrit deployment (which supports SAML). This gerrit deployment will have users from 3 or 4 different companies; mine, which uses Okta for SSO and I’ll like to integrate it with Ger… --- ## [Getting 403 Error when logging into AWS IAM Identity Center through Okta SSO](https://devforum.okta.com/t/getting-403-error-when-logging-into-aws-iam-identity-center-through-okta-sso/31922)
**Author:** [@continent34](https://devforum.okta.com/u/continent34)\ **Replies:** 0\ **Last updated:** [February 7, 2025, 4:03pm UTC](https://devforum.okta.com/t/getting-403-error-when-logging-into-aws-iam-identity-center-through-okta-sso/31922 "2025-02-07T16:03:14Z")
Okta is set up as the identity source for AWS IAM Identity Center for SAML and SCIM provisioning Users logging in to AWS access portal through Okta are getting this error when landing in AWS: 403 Error The request cou… [Next page](https://devforum.okta.com/c/questions/saml/20.md?page=1)