Hi all does anyone have any experiencing with troubleshootin

Question

Hi all does anyone have any experiencing with troubleshooting the SAML integration for SSO in Fleet We re getting the following error ```There was an error with single sign on Please contact your Fleet administrator ``` The `journalctl` logs show ```fleet 4403 level=error ts=2022 07 12T12 55 25 527528789Z component=http user=unauthenticated method=POST uri= api v1 fleet sso callback took=3 385322ms err= response validation failed wrong audience fleet ```

Kathy Satterlee · Answer

Hi < Ryan> The most likely culprit is that the `Entity ID` set up in Fleet doesn t exactly match with the one in your identity provider comfiguration

Ryan · Answer

Thanks < Kathy Satterlee> I ll take a look to see what ours is set to

Ryan · Answer

Do you have any advice on where to find how to determine the Entity ID

Ryan · Answer

If it helps I m trying to integrate with Okta SAML 2 0

Ryan · Answer

Thanks in advance slightly smiling face

Kathy Satterlee · Answer

It looks like Okta might call that the `Audience URI` <https developer okta com docs guides build sso integration saml2 main create your integration>

Ryan · Answer

Ok thanks lemme see what I ve done smile

Ryan · Answer

Ok so I have the following options in the SAML 2 0 configuration for Okta Identity Provider Single Sign On URL Identity Provider Issuer X 509 Certificate IDP Metadata in XML format

Ryan · Answer

In Fleet I have the following Identity provider name Entity ID Issuer URI IDP image URL Metadata Metadata URL

Ryan · Answer

the Metadata XML itself has a ` lt md EntityDescriptor entityID= bla xmlns md= urn oasis names tc SAML 2 0 metadata gt ` attribute and the value of entityID there matches `Identity Provider Issuer`

Ryan · Answer

I get the same error even if I invert these thinking face

Ryan · Answer

if I check the Audience Restriction field in the SAML Settings of Okta for this app I can see it is set to `fleet` should that be set to something else

Kathy Satterlee · Answer

I don t have any personal experience with Okta so I can t answer that one for you Let me see what I can hunt down

Ryan · Answer

Ok no worries slightly smiling face It s a bit tricky given no one appears to be using the same terminology for the fields looking at the docs for various SAML providers smile

Kathy Satterlee · Answer

So much about tech is like the Wild West

Ryan · Answer

I think I ll skip for now especially given you don t support user provisioning yet anyway you still have to go and manually invite a user even to use SSO Thanks for your help so far though

Kathy Satterlee · Answer

I did find this on the Okta support forum gt have you created the app on the Okta side yet Assuming that it s a SAML app your entity ID is usually in the PDF that Okta provides in the sign on tab

Kathy Satterlee · Answer

I ll talk to the team about where we are with prioritizing those tickets and reach back out here later this week to let you know if that s something that might be on the horizon for the near term

Ryan · Answer

Hi I ve managed to get it to work in the end but I think the lack of account provisioning somewhat diminishes the usefulness smile Thanks for your help though I ll keep an eye on those two tickets to follow any progress and check back in the future

Kathy Satterlee · Answer

I m glad you got it running for now