search

flipboxfactory / saml-sp

SAML Service Provider (SP) Plugin for Craft CMS
https://saml-sp.flipboxfactory.com/
Other
19 stars 5 forks source link

Internal server error when logging in via the OKTA EMEA dashboard #146

Closed codename-niels closed 2 years ago

codename-niels commented 2 years ago

When pressing the button to navigate to your app via the OKTA dashboard, it returnes a internal server error. The regular flow when pressing the Via OKTA button when logging in works just fine. Except the users of my app navigate from the OKTA EMEA dashboard to the Craft control panel.

I hope this will be enough info. If not, please feel free to ask for more.

How to reproduce

  1. Navigate to your OKTA EMEA dashboard
  2. Press the button of your application in the OKTA dashboard
  3. Receive an internal server error

The error

Internal Server Error

The server encountered an internal error or misconfiguration and was unable to complete your request.

Please contact the server administrator at webmaster@localhost to inform them of the time this error occurred, and the actions you performed just before this error.

More information about this error may be available in the server error log.

Additionally, a 302 Found error was encountered while trying to use an ErrorDocument to handle the request.

SAML tracer logs

Click to expand 
{
  "requests": [
    {
      "method": "GET",
      "url": "https://REDACTED.okta-emea.com/home/REDACTED_craftcms_1/0oa6bqvxrdxbilcC90i7/aln6bqyjvxfhn94ka0i7?fromHome=true",
      "requestId": "127644",
      "requestHeaders": [
        {
          "name": "Host",
          "value": "REDACTED.okta-emea.com"
        },
        {
          "name": "User-Agent",
          "value": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:92.0) Gecko/20100101 Firefox/92.0"
        },
        {
          "name": "Accept",
          "value": "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8"
        },
        {
          "name": "Accept-Language",
          "value": "en-US,en;q=0.5"
        },
        {
          "name": "Accept-Encoding",
          "value": "gzip, deflate, br"
        },
        {
          "name": "Connection",
          "value": "keep-alive"
        },
        {
          "name": "Cookie",
          "value": "DT={hash:d0620ab7d96e23408d5c2296d3104b2d207c8a7381a46aed6cb1ddd6b6ceb0fb}; proximity_37c22f07822a697ff6e201d4d77de8e5={hash:7e8567a95af43d5c6dafa34529afd874402bb271808bf6c4c0c5987e650ba23d}; enduser_version={hash:6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b}; Okta_Verify_Autopush_1695277588={hash:b5bea41b6c623f7c09f1bf24dcae58ebab3c0cdd90ad966bc43a45b44867e12b}; JSESSIONID={hash:6cef34be30f1d60abf2ea0829aa2}; t={hash:37a8eec1ce19687d132fe29051dca629d164e2c4958ba141d5f4133a33f0688f}; srefresh={hash:9fd2663f644d7486728b11d09206c7cab0d6a63}; sid={hash:cc65fe4d54bfb4bacf3aa85c0edb497adcc4e}; autolaunch_triggered={hash:b5bea41b6ebab3c0cdd90ad966bc43a45b44867e12b}"
        },
        {
          "name": "Upgrade-Insecure-Requests",
          "value": "1"
        },
        {
          "name": "Sec-Fetch-Dest",
          "value": "document"
        },
        {
          "name": "Sec-Fetch-Mode",
          "value": "navigate"
        },
        {
          "name": "Sec-Fetch-Site",
          "value": "same-origin"
        },
        {
          "name": "Sec-Fetch-User",
          "value": "?1"
        }
      ],
      "get": [
        [
          "fromHome",
          "true"
        ]
      ],
      "responseStatus": 302,
      "responseStatusText": "HTTP/2.0 302 Found",
      "responseHeaders": [
        {
          "name": "date",
          "value": "Wed, 06 Oct 2021 07:43:10 GMT"
        },
        {
          "name": "content-length",
          "value": "0"
        },
        {
          "name": "location",
          "value": "https://REDACTED.okta-emea.com/app/REDACTED_craftcms_1/0oa6bqvxrdxbilcC90i7/REDACTED_craftcms_1_link?fromHome=true"
        },
        {
          "name": "server",
          "value": "nginx"
        },
        {
          "name": "public-key-pins-report-only",
          "value": "pin-sha256=\"1UeprJ9h9qxEikb3Jz4M=\"; pin-sha256=\"pNVPNqc6wAQJLD9AGqxoZIUfOm5TE9qQPCgwngkx+CI=\"; pin-sha256=\"8lDSJN+U6Dh5Aex7H16VdplGw=\"; pin-sha256=\"bf8XR/FlNtQkWPn5Gq2lxK59E0SOlPY30=\"; max-age=60; report-uri=\"https://okta.report-uri.com/r/default/hpkp/reportOnly\""
        },
        {
          "name": "x-okta-request-id",
          "value": "YV1Tjofszr58Px1PtTIi6QAAAhU"
        },
        {
          "name": "x-xss-protection",
          "value": "0"
        },
        {
          "name": "p3p",
          "value": "CP=\"HONK\""
        },
        {
          "name": "x-rate-limit-limit",
          "value": "40"
        },
        {
          "name": "x-rate-limit-remaining",
          "value": "39"
        },
        {
          "name": "x-rate-limit-reset",
          "value": "1633506200"
        },
        {
          "name": "content-security-policy",
          "value": "default-src 'self' REDACTED.okta-emea.com *.oktacdn.com; connect-src 'self' REDACTED.okta-emea.com REDACTED-admin.okta-emea.com *.oktacdn.com *.mixpanel.com *.mapbox.com app.pendo.io data.pendo.io pendo-static-5634101834153984.storage.googleapis.com REDACTED.kerberos.okta-emea.com https://oinmanager.okta.com data:; script-src 'unsafe-inline' 'unsafe-eval' 'self' REDACTED.okta-emea.com *.oktacdn.com; style-src 'unsafe-inline' 'self' REDACTED.okta-emea.com *.oktacdn.com app.pendo.io cdn.pendo.io pendo-static-5634101834153984.storage.googleapis.com; frame-src 'self' REDACTED.okta-emea.com REDACTED-admin.okta-emea.com login.okta.com; img-src 'self' REDACTED.okta-emea.com *.oktacdn.com *.tiles.mapbox.com *.mapbox.com app.pendo.io data.pendo.io cdn.pendo.io pendo-static-5634101834153984.storage.googleapis.com data: blob:; font-src 'self' REDACTED.okta-emea.com data: *.oktacdn.com fonts.gstatic.com; report-uri https://okta.report-uri.com/r/d/csp/enforce; report-to csp-enforce"
        },
        {
          "name": "report-to",
          "value": "{\"group\":\"csp-enforce\",\"max_age\":31536000,\"endpoints\":[{\"url\":\"https://okta.report-uri.com/r/d/csp/enforce\"}],\"include_subdomains\":true}"
        },
        {
          "name": "expect-ct",
          "value": "report-uri=\"https://oktaexpectct.report-uri.com/r/t/ct/reportOnly\", max-age=0"
        },
        {
          "name": "cache-control",
          "value": "no-cache, no-store"
        },
        {
          "name": "pragma",
          "value": "no-cache"
        },
        {
          "name": "expires",
          "value": "0"
        },
        {
          "name": "x-frame-options",
          "value": "SAMEORIGIN"
        },
        {
          "name": "content-language",
          "value": "en"
        },
        {
          "name": "strict-transport-security",
          "value": "max-age=315360000; includeSubDomains"
        },
        {
          "name": "x-robots-tag",
          "value": "noindex,nofollow"
        },
        {
          "name": "set-cookie",
          "value": "JSESSIONID=12A77B06927B171A8FA2B9C483F06109; Path=/; Secure; HttpOnly\nt=default; Path=/\nsid=102auBVtdCiSJm1d5--v-jhCg;Version=1;Path=/;Secure;HttpOnly;SameSite=None\nproximity_37c22f07822a697ff6e201d4d77de8e5=E3Bvo4BhvNbafHbEHz+qbD5Mh6pfywi8IcmkE7ZGqW5Ovovgbh/iWjjAZv1zr8S6eG131wZdTcFDRb2BajpndEaT2IRxFmSNGRzzPo20AS+ywKdUDCJFM5mFKilGfqo;Version=1;Path=/;Max-Age=31536000;Secure;Expires=Thu, 06 Oct 2022 07:43:10 GMT;SameSite=None"
        },
        {
          "name": "X-Firefox-Spdy",
          "value": "h2"
        }
      ]
    },
    {
      "method": "GET",
      "url": "https://REDACTED.okta-emea.com/app/REDACTED_craftcms_1/0oa6bqvxrdxbilcC90i7/REDACTED_craftcms_1_link?fromHome=true",
      "requestId": "127644",
      "requestHeaders": [
        {
          "name": "Host",
          "value": "REDACTED.okta-emea.com"
        },
        {
          "name": "User-Agent",
          "value": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:92.0) Gecko/20100101 Firefox/92.0"
        },
        {
          "name": "Accept",
          "value": "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8"
        },
        {
          "name": "Accept-Language",
          "value": "en-US,en;q=0.5"
        },
        {
          "name": "Accept-Encoding",
          "value": "gzip, deflate, br"
        },
        {
          "name": "Connection",
          "value": "keep-alive"
        },
        {
          "name": "Cookie",
          "value": "DT={hash:d0620ab7d96e23408d5c2296d3104b2d207c8a7381a46aed6cb1ddd6b6ceb0fb}; proximity_37c22f07822a697ff6e201d4d77de8e5={hash:7e8567a95af43d5c6dafa34529afd874402bb271808bf6c4c0c5987e650ba23d}; enduser_version={hash:6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b}; Okta_Verify_Autopush_1695277588={hash:b5bea41b6c623f7c09f1bf24dcae58ebab3c0cdd90ad966bc43a45b44867e12b}; JSESSIONID={hash:6139bb21335736351a1d7cc36b5dba9672b38ed49113f4d6db007664b387f46b}; t={hash:37a8eec1ce19687d132fe29051dca629d164e2c4958ba141d5f4133a33f0688f}; srefresh={hash:9fd2663f644f15099f93e66832d47e482529d7486728b11d09206c7cab0d6a63}; sid={hash:cc65fe4d54bfb448babb88e46073a3b45d432972fbacf3aa85c0edb497adcc4e}; autolaunch_triggered={hash:b5bea41b6c623f7c09f1bf24dcae58ebab3c0cdd90ad966bc43a45b44867e12b}"
        },
        {
          "name": "Upgrade-Insecure-Requests",
          "value": "1"
        },
        {
          "name": "Sec-Fetch-Dest",
          "value": "document"
        },
        {
          "name": "Sec-Fetch-Mode",
          "value": "navigate"
        },
        {
          "name": "Sec-Fetch-Site",
          "value": "same-origin"
        },
        {
          "name": "Sec-Fetch-User",
          "value": "?1"
        }
      ],
      "get": [
        [
          "fromHome",
          "true"
        ]
      ],
      "responseStatus": 302,
      "responseStatusText": "HTTP/2.0 302 Found",
      "responseHeaders": [
        {
          "name": "date",
          "value": "Wed, 06 Oct 2021 07:43:10 GMT"
        },
        {
          "name": "content-length",
          "value": "0"
        },
        {
          "name": "location",
          "value": "https://REDACTED.okta-emea.com/app/REDACTED_craftcms_1/exk6bqvxrcepB2fz50i7/sso/saml"
        },
        {
          "name": "server",
          "value": "nginx"
        },
        {
          "name": "public-key-pins-report-only",
          "value": "pin-sha256=\"1UeprJ9h9qxsp8wLsHzaro/ikoTS/AieY2Eikb3Jz4M=\"; pin-sha256=\"pNVPNqc6wAQJLD9AGqxoZIUfOm5TE9qQPCgwngkx+CI=\"; pin-sha256=\"8lDSJN+U6Dh5Aex7H16VdOM7QZH1xgU2kCzi8foplGw=\"; pin-sha256=\"bf8XR/FlNtQkWPn5Gq2lxK59ETzRJ2p3zcF0SOlPY30=\"; max-age=60; report-uri=\"https://okta.report-uri.com/r/default/hpkp/reportOnly\""
        },
        {
          "name": "x-okta-request-id",
          "value": "YV1TjutzPQcGT4bqR6a1FQAADK0"
        },
        {
          "name": "x-xss-protection",
          "value": "0"
        },
        {
          "name": "p3p",
          "value": "CP=\"HONK\""
        },
        {
          "name": "x-rate-limit-limit",
          "value": "40"
        },
        {
          "name": "x-rate-limit-remaining",
          "value": "39"
        },
        {
          "name": "x-rate-limit-reset",
          "value": "1633506200"
        },
        {
          "name": "content-security-policy",
          "value": "default-src 'self' REDACTED.okta-emea.com *.oktacdn.com; connect-src 'self' REDACTED.okta-emea.com REDACTED-admin.okta-emea.com *.oktacdn.com *.mixpanel.com *.mapbox.com app.pendo.io data.pendo.io pendo-static-5634101834153984.storage.googleapis.com REDACTED.kerberos.okta-emea.com https://oinmanager.okta.com data:; script-src 'unsafe-inline' 'unsafe-eval' 'self' REDACTED.okta-emea.com *.oktacdn.com; style-src 'unsafe-inline' 'self' REDACTED.okta-emea.com *.oktacdn.com app.pendo.io cdn.pendo.io pendo-static-5634101834153984.storage.googleapis.com; frame-src 'self' REDACTED.okta-emea.com REDACTED-admin.okta-emea.com login.okta.com; img-src 'self' REDACTED.okta-emea.com *.oktacdn.com *.tiles.mapbox.com *.mapbox.com app.pendo.io data.pendo.io cdn.pendo.io pendo-static-5634101834153984.storage.googleapis.com data: blob:; font-src 'self' REDACTED.okta-emea.com data: *.oktacdn.com fonts.gstatic.com"
        },
        {
          "name": "expect-ct",
          "value": "report-uri=\"https://oktaexpectct.report-uri.com/r/t/ct/reportOnly\", max-age=0"
        },
        {
          "name": "cache-control",
          "value": "no-cache, no-store"
        },
        {
          "name": "pragma",
          "value": "no-cache"
        },
        {
          "name": "expires",
          "value": "0"
        },
        {
          "name": "x-frame-options",
          "value": "SAMEORIGIN"
        },
        {
          "name": "content-language",
          "value": "en"
        },
        {
          "name": "strict-transport-security",
          "value": "max-age=315360000; includeSubDomains"
        },
        {
          "name": "x-robots-tag",
          "value": "noindex,nofollow"
        },
        {
          "name": "set-cookie",
          "value": "JSESSIONID=046DBADCE0C62D9DDBC; Path=/; Secure; HttpOnly\nt=default; Path=/\nsid=102auBVtdCiSJm1d5--v-jhCg;Version=1;Path=/;Secure;HttpOnly;SameSite=None\nproximity_37c22f07822a697ff6e201d4d77de8e5=E3Bvn2AMgAYOhmBEfmo4BhvNbafHbEHz+qbD5Mh6pfywi8IcmkE7ZGqW5Ovovgbh/iWjjAZv1zr8S6eG131wZdTcFDRb2BajpndEaT2IywKdUDCJFM5mFKilGfqo;Version=1;Path=/;Max-Age=31536000;Secure;Expires=Thu, 06 Oct 2022 07:43:10 GMT;SameSite=None"
        },
        {
          "name": "X-Firefox-Spdy",
          "value": "h2"
        }
      ]
    },
    {
      "method": "GET",
      "url": "https://REDACTED.okta-emea.com/app/REDACTED_craftcms_1/exk6bqvxrcepB2fz50i7/sso/saml",
      "requestId": "127644",
      "requestHeaders": [
        {
          "name": "Host",
          "value": "REDACTED.okta-emea.com"
        },
        {
          "name": "User-Agent",
          "value": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:92.0) Gecko/20100101 Firefox/92.0"
        },
        {
          "name": "Accept",
          "value": "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8"
        },
        {
          "name": "Accept-Language",
          "value": "en-US,en;q=0.5"
        },
        {
          "name": "Accept-Encoding",
          "value": "gzip, deflate, br"
        },
        {
          "name": "Connection",
          "value": "keep-alive"
        },
        {
          "name": "Cookie",
          "value": "DT={hash:6cb1ddd6b6ceb0fb}; proximity_37c22f07e201d4d77de8e5={hash:7e8567a95af43d5c6dafa34529afd874402bb271808bf6c4c0c5987e650ba23d}; enduser_version={hash:6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b}; Okta_Verify_Autopush_1695277588={hash:b5bea41b6c623f7c09f1bf24dcae58ebab3c0cdd90ad966bc43a45b44867e12b}; JSESSIONID={hash:0a2d1bcb29ed680627c1c5c58aa8c294078038da5f6f7961bb}; t={hash:37a8eec1ce19687d132fe2902c4958ba141d5f4133a33f0688f}; srefresh={hash:9fd2663f644f15099f93e66832d47e482529d7486728b11d09206c7cab0d6a63}; sid={hash:cc65fe4d54bfb448b972fbacf3aa85c0edb497adcc4e}; autolaunch_triggered={hash:b5bea41b6c6b3c0cdd90ad966bc43a45b44867e12b}"
        },
        {
          "name": "Upgrade-Insecure-Requests",
          "value": "1"
        },
        {
          "name": "Sec-Fetch-Dest",
          "value": "document"
        },
        {
          "name": "Sec-Fetch-Mode",
          "value": "navigate"
        },
        {
          "name": "Sec-Fetch-Site",
          "value": "same-origin"
        },
        {
          "name": "Sec-Fetch-User",
          "value": "?1"
        }
      ],
      "get": [],
      "responseStatus": 200,
      "responseStatusText": "HTTP/2.0 200 OK",
      "responseHeaders": [
        {
          "name": "date",
          "value": "Wed, 06 Oct 2021 07:43:11 GMT"
        },
        {
          "name": "content-type",
          "value": "text/html;charset=utf-8"
        },
        {
          "name": "server",
          "value": "nginx"
        },
        {
          "name": "public-key-pins-report-only",
          "value": "pin-sha256=\"ikoTS/AieY2Eikb3Jz4M=\"; pin-sha256=\"IUfOm5TE9qQPCgwngkx+CI=\"; pin-sha256=\"16VdOM7QZH1xgU2kCzi8foplGw=\"; pin-sha256=\"bf8XR/FlNtQkWPn5Gq2lxK59ETzRJ2p3zcF0SOlPY30=\"; max-age=60; report-uri=\"https://okta.report-uri.com/r/default/hpkp/reportOnly\""
        },
        {
          "name": "vary",
          "value": "Accept-Encoding"
        },
        {
          "name": "x-okta-request-id",
          "value": "YV1TjoW8ZIgJm0v6-@sangAABzI"
        },
        {
          "name": "x-xss-protection",
          "value": "0"
        },
        {
          "name": "p3p",
          "value": "CP=\"HONK\""
        },
        {
          "name": "x-rate-limit-limit",
          "value": "40"
        },
        {
          "name": "x-rate-limit-remaining",
          "value": "39"
        },
        {
          "name": "x-rate-limit-reset",
          "value": "1633506200"
        },
        {
          "name": "content-security-policy",
          "value": "default-src 'self' REDACTED.okta-emea.com *.oktacdn.com; connect-src 'self' REDACTED.okta-emea.com REDACTED-admin.okta-emea.com *.oktacdn.com *.mixpanel.com *.mapbox.com app.pendo.io data.pendo.io pendo-static-5634101834153984.storage.googleapis.com REDACTED.kerberos.okta-emea.com https://oinmanager.okta.com data:; script-src 'unsafe-inline' 'unsafe-eval' 'self' REDACTED.okta-emea.com *.oktacdn.com; style-src 'unsafe-inline' 'self' REDACTED.okta-emea.com *.oktacdn.com app.pendo.io cdn.pendo.io pendo-static-5634101834153984.storage.googleapis.com; frame-src 'self' REDACTED.okta-emea.com REDACTED-admin.okta-emea.com login.okta.com; img-src 'self' REDACTED.okta-emea.com *.oktacdn.com *.tiles.mapbox.com *.mapbox.com app.pendo.io data.pendo.io cdn.pendo.io pendo-static-5634101834153984.storage.googleapis.com data: blob:; font-src 'self' REDACTED.okta-emea.com data: *.oktacdn.com fonts.gstatic.com"
        },
        {
          "name": "expect-ct",
          "value": "report-uri=\"https://oktaexpectct.report-uri.com/r/t/ct/reportOnly\", max-age=0"
        },
        {
          "name": "cache-control",
          "value": "no-cache, no-store"
        },
        {
          "name": "pragma",
          "value": "no-cache"
        },
        {
          "name": "expires",
          "value": "0"
        },
        {
          "name": "x-frame-options",
          "value": "SAMEORIGIN"
        },
        {
          "name": "x-content-type-options",
          "value": "nosniff"
        },
        {
          "name": "content-language",
          "value": "en"
        },
        {
          "name": "strict-transport-security",
          "value": "max-age=315360000; includeSubDomains"
        },
        {
          "name": "x-robots-tag",
          "value": "noindex,nofollow"
        },
        {
          "name": "content-encoding",
          "value": "gzip"
        },
        {
          "name": "set-cookie",
          "value": "JSESSIONID=E1506B765F5725F01183024114954115; Path=/; Secure; HttpOnly\nt=default; Path=/\nsid=102auBVtdCiSJm1d5--v-jhCg;Version=1;Path=/;Secure;HttpOnly;SameSite=None\nproximity_37c22f07822a697ff6e201d4d77de8e5=E3Bvn2ZG2YEvwRrNbfZ8pCfhMDSyBtOshgD6rtRq3ZVoHlOE84J0hhhIOAMgAYOhmBEfmo4BhvNbafHbEHz+qbD5Mh6pfywi8IcmkE7ZGqW5Ovovgbh/iWjjAZv1zr8S6eG131wZdTcFDRb2BajpndEaT2IRxFmSNGRzzPo20AS+ywKdUDCJFM5mFKilGfqo;Version=1;Path=/;Max-Age=31536000;Secure;Expires=Thu, 06 Oct 2022 07:43:11 GMT;SameSite=None"
        },
        {
          "name": "X-Firefox-Spdy",
          "value": "h2"
        }
      ]
    },
    {
      "method": "POST",
      "url": "https://REDACTED.com/en/sso/login/d6c5f7af-aa84-4b33-9da4-c4245e6ef2d2",
      "requestId": "127651",
      "requestHeaders": [
        {
          "name": "Host",
          "value": "REDACTED.com"
        },
        {
          "name": "User-Agent",
          "value": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:92.0) Gecko/20100101 Firefox/92.0"
        },
        {
          "name": "Accept",
          "value": "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8"
        },
        {
          "name": "Accept-Language",
          "value": "en-US,en;q=0.5"
        },
        {
          "name": "Accept-Encoding",
          "value": "gzip, deflate, br"
        },
        {
          "name": "Content-Type",
          "value": "application/x-www-form-urlencoded"
        },
        {
          "name": "Content-Length",
          "value": "11452"
        },
        {
          "name": "Origin",
          "value": "https://REDACTED.okta-emea.com"
        },
        {
          "name": "Connection",
          "value": "keep-alive"
        },
        {
          "name": "Referer",
          "value": "https://REDACTED.okta-emea.com/"
        },
        {
          "name": "Cookie",
          "value": "_ga={hash:REDACTED}; _gid={hash:REDACTED}"
        },
        {
          "name": "Upgrade-Insecure-Requests",
          "value": "1"
        },
        {
          "name": "Sec-Fetch-Dest",
          "value": "document"
        },
        {
          "name": "Sec-Fetch-Mode",
          "value": "navigate"
        },
        {
          "name": "Sec-Fetch-Site",
          "value": "cross-site"
        }
      ],
      "postData": "{overwritten}",
      "post": [
        [
          "SAMLResponse",
          "{hash:REDACTED}"
        ],
        [
          "RelayState",
          "{hash:REDACTED}"
        ]
      ],
      "protocol": "SAML-P",
      "saml": "http://www.okta.com/xxx",
      "samlart": null,
      "responseStatus": 500,
      "responseStatusText": "HTTP/2.0 500 Internal Server Error",
      "responseHeaders": [
        {
          "name": "date",
          "value": "Wed, 06 Oct 2021 07:43:11 GMT"
        },
        {
          "name": "content-type",
          "value": "text/html; charset=iso-8859-1"
        },
        {
          "name": "age",
          "value": "0"
        },
        {
          "name": "x-cache",
          "value": "MISS"
        },
        {
          "name": "strict-transport-security",
          "value": "max-age=63072000"
        },
        {
          "name": "x-content-type-options",
          "value": "nosniff"
        },
        {
          "name": "x-frame-options",
          "value": "SAMEORIGIN"
        },
        {
          "name": "x-xss-protection",
          "value": "1;mode=block"
        },
        {
          "name": "X-Firefox-Spdy",
          "value": "h2"
        }
      ]
    }
  ],
  "timestamp": "2021-10-06T07:43:24.257Z"
}
dsmrt commented 2 years ago

Can you tail the error logs while running this action to see what the error is?

On Mac/linux you can run something like this:

tail -f storage/logs/web.log | grep -A 10 '\[error\]'
kraangprime commented 2 years ago

Error from logs: 

2021-11-30 09:44:14 [10.244.0.13][-][vppmibuovu2664om46m6udod27][error][Exception] Exception: Missing SAMLRequest or SAMLResponse parameter. in /var/www/vendor/simplesamlphp/saml2/src/SAML2/HTTPRedirect.php:112
Stack trace:
#0 /var/www/vendor/flipboxfactory/saml-core/src/services/bindings/Factory.php(40): SAML2\HTTPRedirect->receive()
#1 /var/www/vendor/flipboxfactory/saml-sp/src/controllers/LoginController.php(77): flipbox\saml\core\services\bindings\Factory::receive()
#2 [internal function]: flipbox\saml\sp\controllers\LoginController->actionIndex()
#3 /var/www/vendor/yiisoft/yii2/base/InlineAction.php(57): call_user_func_array()
#4 /var/www/vendor/yiisoft/yii2/base/Controller.php(181): yii\base\InlineAction->runWithParams()
#5 /var/www/vendor/yiisoft/yii2/base/Module.php(534): yii\base\Controller->runAction()
#6 /var/www/vendor/craftcms/cms/src/web/Application.php(287): yii\base\Module->runAction()
#7 /var/www/vendor/yiisoft/yii2/web/Application.php(104): craft\web\Application->runAction()
#8 /var/www/vendor/craftcms/cms/src/web/Application.php(272): yii\web\Application->handleRequest()
#9 /var/www/vendor/yiisoft/yii2/base/Application.php(392): craft\web\Application->handleRequest()
#10 /var/www/public/index.php(21): yii\base\Application->run()
#11 {main}
dsmrt commented 2 years ago

I just tested this and I see no issue on my side. It looks like you have a configuration issue with your setup since Okta isn't sending the SAMLResponse which is absolutely necessary.

Here are the first three steps of my Okta setup:

step 1)

Screen Shot 2021-11-30 at 11 14 37 AM

step 2)

Screen Shot 2021-11-30 at 11 14 47 AM

step 3)

Screen Shot 2021-11-30 at 11 15 41 AM

The important part here is the sign on url.

Does step three look much different?

Do you have some proxying going on that could be removing POST data?

kraangprime commented 2 years ago

Thank you for a fast reply.

Our setup is exactly as on images.

Do you have some proxying going on that could be removing POST data?

Actually yes, we have varnish as a proxy that might be in the way. We will double check what is going on there, as we already have a rules in place that should whitelist, or better to say passthrough post requests for saml.

Also, an odd thing is that if we go directly to url like ourwebiste.com/admin we are promoted with login via saml button, or if we are logged in we are properly redirected to admin panel - this is how we are using it for some time now. So its only affected when you click in okta app list on craft app icon.

dsmrt commented 2 years ago

Yes. I do find that kind of odd. Login that is initiated from the SP (Craft) works similarly to IdP (Okta) initiated.

The tracer you posted didn't show too much useful information but you should see a POST or GET variable named SAMLResponse that has a base 64 string.

dsmrt commented 2 years ago

Let me know if you are still seeing issues here. Closing for now.