SAML pass through reference architecture

This reference architecture describes the components, flow, and requirements to integrate SAML passthrough apps and Access Gateway.

Topics:

Architecture

The SAML pass through architecture is composed of:

  • Split DNS: Internal users access the SAML-aware app with the same DNS name as external users. However, the address provided is either the IP address of Access Gateway, for external users, or the IP address of the SAML-aware app, for internal users.
  • Okta SAML app: An Okta-based app that's hidden from the user.
  • Access Gateway and the Access Gateway app: Proxies SAML requests. The Access Gateway app is hidden from users.
  • Okta bookmark app: Used to access the app by users in an Okta org.

Flow

External internet user Internal user
  1. The user requests app access.
  2. Access Gateway intercepts the request and redirects to Okta for a SAML assertion.
  3. The user sends the SAML authorization request to Okta, and signs in to Okta according to the policies.
  4. Okta generates a SAML assertion for Access Gateway.
  5. The user presents the SAML assertion to Access Gateway and Access Gateway creates an Access Gateway session cookie.
  6. Access Gateway proxies request to SAML app.
  7. The app requests a SAML assertion from Okta.
  8. Access Gateway proxies the SAML AuthN request to browser.
  9. The browser sends the SAML authorization request to Okta.
  10. Okta generates the SAML assertion based on the access policy. Because the user is already signed into Okta, reauthentication isn't required.
  11. The browser sends the SAML assertion to Access Gateway.
  12. Access Gateway proxies the SAML assertion to the app.
  13. The app reads the SAML assertion, creates a local session, and passes the content to Access Gateway.
  14. Access Gateway passes the app session and the content to the user.
  1. The user requests app access.
  2. The app requests SAML assertion from Okta.
  3. The browser sends a SAML AuthN request to Okta.
  4. Okta authenticates the user and generates SAML assertion based on the access policy.
  5. The browser sends the SAML assertion to the app.
  6. The app reads the SAML assertion, creates a local session, and passes the content to the user.

Components and requirements

Component Description and requirements
Okta Access Gateway All versions of Okta Access Gateway support SAML pass through.

Access Gateway app

 App that's defined within Access Gateway, but hidden from everyday users.
Okta SAML app A hidden app that's used by Okta.
Okta Bookmark app A bookmark app that's integrated in the Okta org.
SAML Application An internal SAML app, which uses the same name as external references, differentiated by split DNS.
External URL External URL specified by the Public Domain field in Access Gateway. It uses the same fully qualified domain name (FQDN) as the internal SAML app, but resolves to a different IP address depending on whether the request uses public or private DNS. For example: https://saml-app.example.com