SAML help with new install using Okta

Moderator: crythias

Post Reply
wvotta
Znuny newbie
Posts: 4
Joined: 15 Oct 2026, 23:42
Znuny Version: 7.3.8
Real Name: William Votta
Company: Emerson (Topworx)

SAML help with new install using Okta

Post by wvotta »

Hi all!

I've been beating my head against a wall trying to make this work.

I've a vanilla install that wasn't being used as we've done upgrades. Presently we're at 7.3.8 (was at 7.3.3 until yesterday). The SAML login button shows in the login page and when clicked it does do the Okta SSO but it comes back and gives the error of needing username and password.

I'm trying to get both auth and sync working for agents. I'll probably want customers too but I wanted to start with this. I've tried manually adding my email address as an admin user and I've tried having someone else log in but both fail exactly the same way:

ERROR: Znuny-CGI-18 Perl: 5.26.3 OS: linux Time: Thu Oct 15 17:41:33 2026

Message: Need User!

RemoteAddress: 10.212.39.81
RequestURI: /znuny/index.pl?Action=Login

Traceback (191791):
Module: Kernel::System::Auth::DB::Auth Line: 79
Module: Kernel::System::Auth::Auth Line: 167
Module: Kernel::System::Web::InterfaceAgent::Run Line: 276
Module: ModPerl::ROOT::ModPerl::Registry::opt_znuny_bin_cgi_2dbin_index_2epl::handler Line: 39
Module: (eval) (v1.99) Line: 207
Module: ModPerl::RegistryCooker::run (v1.99) Line: 207
Module: ModPerl::RegistryCooker::default_handler (v1.99) Line: 173
Module: ModPerl::Registry::handler (v1.99) Line: 32

ERROR: Znuny-CGI-18 Perl: 5.26.3 OS: linux Time: Thu Oct 15 17:41:33 2026

Message: Parameter 'ExpectedSAMLRequestID' is needed!

RemoteAddress: 10.212.39.81
RequestURI: /znuny/index.pl?Action=Login

Traceback (191791):
Module: Kernel::System::Auth::SAML::Response::IsValid Line: 121
Module: Kernel::System::Auth::SAML::Auth Line: 142
Module: Kernel::System::Auth::Auth Line: 167
Module: Kernel::System::Web::InterfaceAgent::Run Line: 276
Module: ModPerl::ROOT::ModPerl::Registry::opt_znuny_bin_cgi_2dbin_index_2epl::handler Line: 39
Module: (eval) (v1.99) Line: 207
Module: ModPerl::RegistryCooker::run (v1.99) Line: 207
Module: ModPerl::RegistryCooker::default_handler (v1.99) Line: 173
Module: ModPerl::Registry::handler (v1.99) Line: 32

ERROR: Znuny-CGI-18 Perl: 5.26.3 OS: linux Time: Thu Oct 15 17:41:33 2026

Message: SAML response is not valid.

RemoteAddress: 10.212.39.81
RequestURI: /znuny/index.pl?Action=Login

Traceback (191791):
Module: Kernel::System::Auth::SAML::Auth Line: 144
Module: Kernel::System::Auth::Auth Line: 167
Module: Kernel::System::Web::InterfaceAgent::Run Line: 276
Module: ModPerl::ROOT::ModPerl::Registry::opt_znuny_bin_cgi_2dbin_index_2epl::handler Line: 39
Module: (eval) (v1.99) Line: 207
Module: ModPerl::RegistryCooker::run (v1.99) Line: 207
Module: ModPerl::RegistryCooker::default_handler (v1.99) Line: 173
Module: ModPerl::Registry::handler (v1.99) Line: 32

ERROR: Znuny-CGI-18 Perl: 5.26.3 OS: linux Time: Thu Oct 15 17:41:33 2026

Message: Need UserLogin or UserID!

RemoteAddress: 10.212.39.81
RequestURI: /znuny/index.pl?Action=Login

Traceback (191791):
Module: Kernel::System::User::UserLookup Line: 1029
Module: Kernel::System::Auth::Auth Line: 262
Module: Kernel::System::Web::InterfaceAgent::Run Line: 276
Module: ModPerl::ROOT::ModPerl::Registry::opt_znuny_bin_cgi_2dbin_index_2epl::handler Line: 39
Module: (eval) (v1.99) Line: 207
Module: ModPerl::RegistryCooker::run (v1.99) Line: 207
Module: ModPerl::RegistryCooker::default_handler (v1.99) Line: 173
Module: ModPerl::Registry::handler (v1.99) Line: 32

[Thu Oct 15 17:41:33 2026] -e: Apache2::Reload: Can't locate (set by Moose)
[Thu Oct 15 17:41:33 2026] -e: Apache2::Reload: Can't locate (set by Moose)
Top
wvotta
Znuny newbie
Posts: 4
Joined: 15 Oct 2026, 23:42
Znuny Version: 7.3.8
Real Name: William Votta
Company: Emerson (Topworx)

Re: SAML help with new install using Okta

Post by wvotta »

Here's the relevant parts of my kernel config:

Code: Select all

    #
    # Auth via SAML 2.0
    #
    $Self->{'AuthModule1'} = 'Kernel::System::Auth::SAML';

    $Self->{'AuthModule::SAML::RequestMetaDataURL1'} = 'https://emerson.okta.com/app/exk1e718362BnXRko2p8/sso/saml/metadata';

    # Button text can be translated per system with module AdminTranslation
    $Self->{'AuthModule::SAML::RequestLoginButtonText1'}      = 'Log in via SAML';
    $Self->{'AuthModule::SAML::RequestAssertionConsumerURL1'} = ( $Self->{HttpType} // '' ) . '://' . $Self->{FQDN} . '/' . $Self->{ScriptAlias} . 'index.pl?Action=Login';

    $Self->{'AuthModule::SAML::Issuer1'} = "https://usordaspzzzwi01.emrsn.org/znuny/";

    # # Optional, CACert of the identity provider (IdP)
    $Self->{'AuthModule::SAML::IdPCACert1'} = '/otrs/cacert.pem';
    #
    # Auth sync via SAML 2.0
    #

    $Self->{'AuthSyncModule1'} = 'Kernel::System::Auth::Sync::SAML';

    # references the attributes of the SAML response
    $Self->{'AuthSyncModule::SAML::UserSyncMap1'} = {
        UserFirstname => 'givenname',
        UserLastname  => 'surname',
        UserEmail     => 'emailaddress',
    };

    $Self->{'AuthSyncModule::SAML::UserSyncInitialGroups1'} = [
        'users',
    ];

    $Self->{'AuthSyncModule::SAML::UserSyncGroupsDefinition::Attribute1'} = 'MemberOf';
    $Self->{'AuthSyncModule::SAML::UserSyncGroupsDefinition1'} = {
        Support => {
             users => {
                 rw => 1,
             },
    #         ZnunyGroup2 => {
    #             ro   => 1,
    #             note => 1,
    #         },
         },
    };
Top
wvotta
Znuny newbie
Posts: 4
Joined: 15 Oct 2026, 23:42
Znuny Version: 7.3.8
Real Name: William Votta
Company: Emerson (Topworx)

Re: SAML help with new install using Okta

Post by wvotta »

I've used a SAML inspector and the output looks like this when the auth happens:
<?xml version="1.0" encoding="UTF-8"?>
<saml2p:Response Destination="https://usordaspzzzwi01.emrsn.org/znuny ... tion=Login" ID="id-13093381715519462942077865981" InResponseTo="NETSAML2_3031e2d384b7998789b7e26035ff0b82819afe6e9ac5a97ea1ebe5cbaf35bdc2" IssueInstant="2026-10-15T18:54:07.147Z" Version="2.0" xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:xs="http://www.w3.org/2001/XMLSchema">
<saml2:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity" xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">http://www.okta.com/exk1e718362BnXRko2p8</saml2:Issuer>
<ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:SignedInfo>
<ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
<ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/>
<ds:Reference URI="#id-13093381715519462942077865981">
<ds:Transforms>
<ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
<ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#">
<ec:InclusiveNamespaces PrefixList="xs" xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#"/>
</ds:Transform>
</ds:Transforms>
<ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
<ds:DigestValue>FiPVNKKniXi1oCFTsmAays9/KTKx3KIYtQYCqfT2loY=</ds:DigestValue>
</ds:Reference>
</ds:SignedInfo>
<ds:SignatureValue></ds:SignatureValue>
<ds:KeyInfo>
<ds:X509Data>
<ds:X509Certificate></ds:X509Certificate>
</ds:X509Data>
</ds:KeyInfo>
</ds:Signature>
<saml2p:Status xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol">
<saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/>
</saml2p:Status>
<saml2:Assertion ID="id-1953646535163376341790981412" IssueInstant="2026-10-15T18:54:07.147Z" Version="2.0" xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xs="http://www.w3.org/2001/XMLSchema">
<saml2:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity" xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">http://www.okta.com/exk1e718362BnXRko2p8</saml2:Issuer>
<ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:SignedInfo>
<ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
<ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/>
<ds:Reference URI="#id-1953646535163376341790981412">
<ds:Transforms>
<ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
<ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#">
<ec:InclusiveNamespaces PrefixList="xs" xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#"/>
</ds:Transform>
</ds:Transforms>
<ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
<ds:DigestValue>LJB8M4xyo6TEjYzoJ+8icyMM5N8ix1jbXFiBPrU+NB0=</ds:DigestValue>
</ds:Reference>
</ds:SignedInfo>
<ds:SignatureValue></ds:SignatureValue>
<ds:KeyInfo>
<ds:X509Data>
<ds:X509Certificate></ds:X509Certificate>
</ds:X509Data>
</ds:KeyInfo>
</ds:Signature>
<saml2:Subject xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">
<saml2:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress">William.Votta@emerson.com</saml2:NameID>
<saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
<saml2:SubjectConfirmationData InResponseTo="NETSAML2_3031e2d384b7998789b7e26035ff0b82819afe6e9ac5a97ea1ebe5cbaf35bdc2" NotOnOrAfter="2026-10-15T18:59:07.147Z" Recipient="https://usordaspzzzwi01.emrsn.org/znuny ... on=Login"/>
</saml2:SubjectConfirmation>
</saml2:Subject>
<saml2:Conditions NotBefore="2026-10-15T18:49:07.147Z" NotOnOrAfter="2026-10-15T18:59:07.147Z" xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">
<saml2:AudienceRestriction>
<saml2:Audience>https://usordaspzzzwi01.emrsn.org/znuny ... 2:Audience>
</saml2:AudienceRestriction>
</saml2:Conditions>
<saml2:AuthnStatement AuthnInstant="2026-10-15T18:54:07.147Z" SessionIndex="NETSAML2_3031e2d384b7998789b7e26035ff0b82819afe6e9ac5a97ea1ebe5cbaf35bdc2" xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">
<saml2:AuthnContext>
<saml2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml2:AuthnContextClassRef>
</saml2:AuthnContext>
</saml2:AuthnStatement>
<saml2:AttributeStatement xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">
<saml2:Attribute Name="givenname" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified">
<saml2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">William</saml2:AttributeValue>
</saml2:Attribute>
<saml2:Attribute Name="surname" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified">
<saml2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">Votta</saml2:AttributeValue>
</saml2:Attribute>
<saml2:Attribute Name="emailaddress" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified">
<saml2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">William.Votta@emerson.com</saml2:AttributeValue>
</saml2:Attribute>
<saml2:Attribute Name="uid" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified">
<saml2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">William.Votta@emerson.com</saml2:AttributeValue>
</saml2:Attribute>
<saml2:Attribute Name="login" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified">
<saml2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">William.Votta@emerson.com</saml2:AttributeValue>
</saml2:Attribute>
</saml2:AttributeStatement>
</saml2:Assertion>
</saml2p:Response>
Top
wvotta
Znuny newbie
Posts: 4
Joined: 15 Oct 2026, 23:42
Znuny Version: 7.3.8
Real Name: William Votta
Company: Emerson (Topworx)

Re: SAML help with new install using Okta

Post by wvotta »

I removed the certs and sigs from the SAML inspection.

What am I doing wrong here?
Top
Post Reply

Return to “Help”