why okta does not redirect back to service provider in SSO case - single-sign-on

Question

i am using open source project https://github.com/jpf/okta-pysaml2-example for learning okta, saml, sso and flask. i have made the required app integration setting in okta. When i start flast web server as service provider and access http://localhost:5000 using a ngrok, i get redirected to okta login page, where i fillup user/pass. on click submit button , okta lands on https://dev-023456-admin.okta.com/admin/getting-started. however, ideally okta should redirect back to the service provider. what is wrong here? i have configured metadata properly on both the sides. what could be the problem here? how can i narrow down the issue?
<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" entityID="http://www.okta.com/abcdefghijklm">
<md:IDPSSODescriptor WantAuthnRequestsSigned="false" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
<md:KeyDescriptor use="signing">
<ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:X509Data>
<ds:X509Certificate>MIIDqDCCApCgAwIBAgIGAX2Vjf7/MA0GCSqGSIb3DQEBCwUAMIGUMQswCQYDVQQGEwJVUzETMBEG A1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsGA1UECgwET2t0YTEU MBIGA1UECwwLU1NPUHJvdmlkZXIxFTATBgNVBAMMDGRldi0wMjg4NzY4NjEcMBoGCSqGSIb3DQEJ ARYNaW5mb0Bva3RhLmNvbTAeFw0yMTEyMDcxNTM5NTBaFw0zMTEyMDcxNTQwNTBaMIGUMQswCQYD VQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsG A1UECgwET2t0YTEUMBIGA1UECwwLU1NPUHJvdmlkZXIxFTATBgNVBAMMDGRldi0wMjg4NzY4NjEc MBoGCSqGSIb3DQEJARYNaW5mb0Bva3RhLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoC ggEBAIY6Ek4yvOB3pF4+IwAgVYyxdwOXi4AoorFUmgJ1Sv8kLc6SSApwIEKj2N/F8tYDxZKEGcV7 jap8gdYZcLpm4rKfNGw0jjQ+mCT4fcUdzLTsXQ1vzTy+KILvi1Ki3cgzEKt+Oir106XKDCgp+BGc PgGKRQQroxqrUWX12yEGyZ4D7pLt5Pg4SBC9o1xRfP+hK82ev1eO+hmp39pl6QDKPG0tV6FJI/SX bnchBNpGxT2qcMO8LzudQBS9fT7Nu0WPJGRRF/zQdB+ScHvBFnjlTKjEYPwM2yNx5FYMfcZM/qZH jyAocVdAR4LMEOi1jZwlPIgESIyCXYFVptoqm1U+Lh0CAwEAATANBgkqhkiG9w0BAQsFAAOCAQEA c8zc0J0p/oq8zHfVobh0QNov4NUS81iDl0ZcRC3LDJ50X360NPM3q7JRfwVMGGUWs0WNm+km0poa XYzWnZUYbRbeuvXB/lyCjUEVneF3quTpzifffVDO8sl1qosEOFlOPf1NOMiVMwRyBHqWRsbL96E1 TVBK7ezaIa/okXiPm0QflMHV9Sg1HyQHvAxo/topQI3FzrZRehrjol0K0vg29ZiV3Y32Ym2mAWD1 3fV7Fy8QcrbQpZseojkUqqfcIaCAOUtiK+oK86yDTkd6C6Ed5Ib0K7Ckwr0FdZ6w2wo4u+UIAnK+ IOOerfagyzpaT0lAPJ4G55sVX5min7plRDfqfA==</ds:X509Certificate>
</ds:X509Data>
</ds:KeyInfo>
</md:KeyDescriptor>
<md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</md:NameIDFormat>
<md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</md:NameIDFormat>
<md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://dev-02887686.okta.com/app/dev-02887686_testapp_1/abcdefghijklm/sso/saml"/>
<md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://dev-02887686.okta.com/app/dev-02887686_testapp_1/abcdefghijklm/sso/saml"/>
</md:IDPSSODescriptor>
</md:EntityDescriptor>
sp side config
'service': {
'sp': {
'endpoints': {
'assertion_consumer_service': [
("http://example123.loca.lt/saml/sso/example-okta-com", BINDING_HTTP_POST),
("https://example123.loca.lt/saml/sso/example-okta-com", BINDING_HTTP_POST),
("http://example123.loca.lt/saml/sso/example-okta-com", BINDING_HTTP_REDIRECT),
("https://example123.loca.lt/saml/sso/example-okta-com", BINDING_HTTP_REDIRECT)
],
"single_logout_service": [
("http://example123.loca.lt/saml/slo/okta", BINDING_HTTP_REDIRECT),
("http://example123.loca.lt/saml/slo/okta", BINDING_HTTP_POST),
],
},
"required_attributes": ['displayName', 'mail', ],
"metadata_key_usage": "both",
"enc_cert": "use",
'allow_unsolicited': True,
'authn_requests_signed': False,
'logout_requests_signed': False,
'want_assertions_signed': True,
'want_response_signed': False,
},
},
"key_file": "./pki/mykey.pem",
"cert_file": "./pki/mycert.pem",
"xmlsec_binary": '/usr/bin/xmlsec1',
'encryption_keypairs': [
{
'key_file': "./pki/mykey.pem",
'cert_file': "./pki/mycert.pem",
},
],
setting in okta
Single Sign On URL http://example123.loca.lt/saml/sso/example-okta-com
Recipient URL http://example123.loca.lt/saml/sso/example-okta-com
Destination URL http://example123.loca.lt/saml/sso/example-okta-com
Audience Restriction http://example123.loca.lt/saml/sso/example-okta-com
service provider python fastapi code
metadata_url_for = {
# you can have multiple 'Application Integration' settings in okta and can use here for testing.
# key : value (metadata link for 'Application Integration' created in okta)
'app_integration': 'https://dev-02887686.okta.com/app/exk2zsnf574m2JD4w5d7/sso/saml/metadata'
#'app_integration': 'https://dev-02887686.okta.com/app/dev-02887686_testapp_1/exk2zsnf574m2JD4w5d7/sso/saml'
}
# get saml client configuration for a given idP name. Here SAML client means
# Service Provider.
def saml_client_for(idp_name=None):
'''
Given the name of an IdP, returns a saml configuration.
The configuration is a hash for use by saml2.config.Config
'''
if idp_name not in metadata_url_for:
raise Exception("Settings for IDP '{}' not found".format(idp_name))
rv = requests.get(metadata_url_for[idp_name]) # make http get request with given url and read its response in 'rv'
settings = {
'entityid': 'http://example123.loca.lt/saml/sso/example-okta-com',
'metadata': {
'inline': [rv.text],
},
'service': {
'sp': {
'endpoints': {
'assertion_consumer_service': [
("http://example123.loca.lt/saml/sso/example-okta-com", BINDING_HTTP_POST),
("https://example123.loca.lt/saml/sso/example-okta-com", BINDING_HTTP_POST)
],
"single_logout_service": [
("http://example123.loca.lt/saml/slo/okta", BINDING_HTTP_REDIRECT),
("http://example123.loca.lt/saml/slo/okta", BINDING_HTTP_POST),
],
},
"required_attributes": ['displayName', 'mail', ],
"metadata_key_usage": "both",
"enc_cert": "use",
'allow_unsolicited': True,
'authn_requests_signed': False,
'logout_requests_signed': False,
'want_assertions_signed': True,
'want_response_signed': False,
},
},
"key_file": "./pki/mykey.pem",
"cert_file": "./pki/mycert.pem",
"xmlsec_binary": '/usr/bin/xmlsec1',
'encryption_keypairs': [
{
'key_file': "./pki/mykey.pem",
'cert_file': "./pki/mycert.pem",
},
],
}
spConfig = Saml2Config()
spConfig.load(settings)
spConfig.allow_unknown_attributes = True
saml_client = Saml2Client(config=spConfig)
return saml_client
#app.post("/saml/sso/example-okta-com")
async def idp_initiated(request: Request):
print("In idp_initiated....\n")
key_str = 'app_integration'
saml_client = saml_client_for(key_str)
form = await request.form()
authn_response = saml_client.parse_authn_request_response(
form.get('SAMLResponse'),
entity.BINDING_HTTP_POST)
authn_response.get_identity()
user = User(authn_response.name_id, authn_response.ava, authn_response)
request.session["user_name_id"] = str(user.name_id)
user_store = {'first_name': authn_response.ava['displayName'][0], 'last_name': authn_response.ava['displayName'][0],
'user_name': authn_response.ava['cn'][0]}
# instead of responding with user data. We are redirecting it to home page.
# resp = JSONResponse(user_store)
resp = RedirectResponse("https://example123.com/home")
uid = rndstr(32)
uid2user[uid] = user
resp.set_cookie(key='spauthn', value=authn_response.name_id, httponly=True, expires=1800)
resp.status_code = 302
return resp
#app.get("/saml/login/example-okta-com")
def sp_initiated():
print("In sp_initiated....\n")
key_str = 'app_integration'
saml_client = saml_client_for(key_str)
reqid, info = saml_client.prepare_for_authenticate()
redirect_url = None
# Select the IdP URL to send the AuthN request to
for key, value in info['headers']:
if key == 'Location':
redirect_url = value
response = fastapi.responses.RedirectResponse(redirect_url)
response.headers['Cache-Control'] = 'no-cache, no-store'
response.headers['Pragma'] = 'no-cache'
return response
then i land to

Answer 1

You are using metadata for idp flow. In idp flow you don't get redirected to SP this way. Use metadata for Sp flow instead which should contain the redirect url pointing to your service so idp can redirect