Skip to demo content
Step 1 of 8: User requests protected resource
← All demos

SP-Initiated SAML with Okta

1. User requests protected resource

User navigates to the app dashboard. The app checks for a valid session and finds none, so it generates a SAML AuthnRequest with a unique ID and redirects the browser to Okta.

What the user sees

https://secrets.example.com/dashboard
Demo simulation — do not enter real credentials
Redirecting to login...

What's happening (HTTP)

  1. REQUEST Browser → App
    GET https://secrets.example.com/dashboard
    Cookie: (none)
    No session cookie present
  2. INTERNAL App → App
    Session check + AuthnRequest generation
    No valid session found. Generate AuthnRequest with unique ID (_request_abc123), store ID for InResponseTo validation, set RelayState to /dashboard.
  3. RESPONSE App → Browser
    302 Found
    Location: https://contoso.okta.com/app/ots-saml/exk1234/sso/saml?
    SAMLRequest=base64-deflate-encoded-xml
    &RelayState=%2Fdashboard
    &SigAlg=http://www.w3.org/2001/04/xmldsig-more%23rsa-sha256
    &Signature=base64-encoded-signature
    HTTP-Redirect binding: AuthnRequest is deflated, base64-encoded, and URL-encoded. Signature covers SAMLRequest + RelayState + SigAlg concatenated.

Legend

Browser request
Server response
Server-to-server
Internal
← All demos
An educational demo, not a reference implementation v0.3.0