SAML help with new install using Okta

[wvotta]

Hi all!

I've been beating my head against a wall trying to make this work.

I've a vanilla install that wasn't being used as we've done upgrades. Presently we're at 7.3.8 (was at 7.3.3 until yesterday). The SAML login button shows in the login page and when clicked it does do the Okta SSO but it comes back and gives the error of needing username and password.

I'm trying to get both auth and sync working for agents. I'll probably want customers too but I wanted to start with this. I've tried manually adding my email address as an admin user and I've tried having someone else log in but both fail exactly the same way:

ERROR: Znuny-CGI-18 Perl: 5.26.3 OS: linux Time: Thu Oct 15 17:41:33 2026

Message: Need User!

RemoteAddress: 10.212.39.81
RequestURI: /znuny/index.pl?Action=Login

Traceback (191791):
Module: Kernel::System::Auth::DB::Auth Line: 79
Module: Kernel::System::Auth::Auth Line: 167
Module: Kernel::System::Web::InterfaceAgent::Run Line: 276
Module: ModPerl::ROOT::ModPerl::Registry::opt_znuny_bin_cgi_2dbin_index_2epl::handler Line: 39
Module: (eval) (v1.99) Line: 207
Module: ModPerl::RegistryCooker::run (v1.99) Line: 207
Module: ModPerl::RegistryCooker::default_handler (v1.99) Line: 173
Module: ModPerl::Registry::handler (v1.99) Line: 32

ERROR: Znuny-CGI-18 Perl: 5.26.3 OS: linux Time: Thu Oct 15 17:41:33 2026

Message: Parameter 'ExpectedSAMLRequestID' is needed!

RemoteAddress: 10.212.39.81
RequestURI: /znuny/index.pl?Action=Login

Traceback (191791):
Module: Kernel::System::Auth::SAML::Response::IsValid Line: 121
Module: Kernel::System::Auth::SAML::Auth Line: 142
Module: Kernel::System::Auth::Auth Line: 167
Module: Kernel::System::Web::InterfaceAgent::Run Line: 276
Module: ModPerl::ROOT::ModPerl::Registry::opt_znuny_bin_cgi_2dbin_index_2epl::handler Line: 39
Module: (eval) (v1.99) Line: 207
Module: ModPerl::RegistryCooker::run (v1.99) Line: 207
Module: ModPerl::RegistryCooker::default_handler (v1.99) Line: 173
Module: ModPerl::Registry::handler (v1.99) Line: 32

ERROR: Znuny-CGI-18 Perl: 5.26.3 OS: linux Time: Thu Oct 15 17:41:33 2026

Message: SAML response is not valid.

RemoteAddress: 10.212.39.81
RequestURI: /znuny/index.pl?Action=Login

Traceback (191791):
Module: Kernel::System::Auth::SAML::Auth Line: 144
Module: Kernel::System::Auth::Auth Line: 167
Module: Kernel::System::Web::InterfaceAgent::Run Line: 276
Module: ModPerl::ROOT::ModPerl::Registry::opt_znuny_bin_cgi_2dbin_index_2epl::handler Line: 39
Module: (eval) (v1.99) Line: 207
Module: ModPerl::RegistryCooker::run (v1.99) Line: 207
Module: ModPerl::RegistryCooker::default_handler (v1.99) Line: 173
Module: ModPerl::Registry::handler (v1.99) Line: 32

ERROR: Znuny-CGI-18 Perl: 5.26.3 OS: linux Time: Thu Oct 15 17:41:33 2026

Message: Need UserLogin or UserID!

RemoteAddress: 10.212.39.81
RequestURI: /znuny/index.pl?Action=Login

Traceback (191791):
Module: Kernel::System::User::UserLookup Line: 1029
Module: Kernel::System::Auth::Auth Line: 262
Module: Kernel::System::Web::InterfaceAgent::Run Line: 276
Module: ModPerl::ROOT::ModPerl::Registry::opt_znuny_bin_cgi_2dbin_index_2epl::handler Line: 39
Module: (eval) (v1.99) Line: 207
Module: ModPerl::RegistryCooker::run (v1.99) Line: 207
Module: ModPerl::RegistryCooker::default_handler (v1.99) Line: 173
Module: ModPerl::Registry::handler (v1.99) Line: 32

[Thu Oct 15 17:41:33 2026] -e: Apache2::Reload: Can't locate (set by Moose)
[Thu Oct 15 17:41:33 2026] -e: Apache2::Reload: Can't locate (set by Moose)

[wvotta]

Here's the relevant parts of my kernel config:

Code: Select all

    #
    # Auth via SAML 2.0
    #
    $Self->{'AuthModule1'} = 'Kernel::System::Auth::SAML';

    $Self->{'AuthModule::SAML::RequestMetaDataURL1'} = '**redacted, lol trust me it works and is the right metadata url**';

    # Button text can be translated per system with module AdminTranslation
    $Self->{'AuthModule::SAML::RequestLoginButtonText1'}      = 'Log in via SAML';
    $Self->{'AuthModule::SAML::RequestAssertionConsumerURL1'} = ( $Self->{HttpType} // '' ) . '://' . $Self->{FQDN} . '/' . $Self->{ScriptAlias} . 'index.pl?Action=Login';

    $Self->{'AuthModule::SAML::Issuer1'} = "**redacted, trust me it's the right URL, when this was wrong we got a different error and the login page wouldn't load**";

    # # Optional, CACert of the identity provider (IdP)
    $Self->{'AuthModule::SAML::IdPCACert1'} = '/otrs/cacert.pem';
    #
    # Auth sync via SAML 2.0
    #

    $Self->{'AuthSyncModule1'} = 'Kernel::System::Auth::Sync::SAML';

    # references the attributes of the SAML response
    $Self->{'AuthSyncModule::SAML::UserSyncMap1'} = {
        UserFirstname => 'givenname',
        UserLastname  => 'surname',
        UserEmail     => 'emailaddress',
    };

    $Self->{'AuthSyncModule::SAML::UserSyncInitialGroups1'} = [
        'users',
    ];

    $Self->{'AuthSyncModule::SAML::UserSyncGroupsDefinition::Attribute1'} = 'MemberOf';
    $Self->{'AuthSyncModule::SAML::UserSyncGroupsDefinition1'} = {
        Support => {
             users => {
                 rw => 1,
             },
    #         ZnunyGroup2 => {
    #             ro   => 1,
    #             note => 1,
    #         },
         },
    };

[wvotta]

I've used a SAML inspector and the output looks like this when the auth happens:
<?xml version="1.0" encoding="UTF-8"?>
<saml2p:Response Destination="**redacted**/index.pl?Action=Login" ID="id-13093381715519462942077865981" InResponseTo="NETSAML2_3031e2d384b7998789b7e26035ff0b82819afe6e9ac5a97ea1ebe5cbaf35bdc2" IssueInstant="2026-10-15T18:54:07.147Z" Version="2.0" xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:xs="http://www.w3.org/2001/XMLSchema">
<saml2:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity" xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">http://www.okta.com/exk1e718362BnXRko2p8</saml2:Issuer>
<ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:SignedInfo>
<ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
<ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/>
<ds:Reference URI="#id-13093381715519462942077865981">
<ds:Transforms>
<ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
<ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#">
<ec:InclusiveNamespaces PrefixList="xs" xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#"/>
</ds:Transform>
</ds:Transforms>
<ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
<ds:DigestValue>FiPVNKKniXi1oCFTsmAays9/KTKx3KIYtQYCqfT2loY=</ds:DigestValue>
</ds:Reference>
</ds:SignedInfo>
<ds:SignatureValue></ds:SignatureValue>
<ds:KeyInfo>
<ds:X509Data>
<ds:X509Certificate></ds:X509Certificate>
</ds:X509Data>
</ds:KeyInfo>
</ds:Signature>
<saml2p:Status xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol">
<saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/>
</saml2p:Status>
<saml2:Assertion ID="id-1953646535163376341790981412" IssueInstant="2026-10-15T18:54:07.147Z" Version="2.0" xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xs="http://www.w3.org/2001/XMLSchema">
<saml2:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity" xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">**redacted**</saml2:Issuer>
<ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:SignedInfo>
<ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
<ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/>
<ds:Reference URI="#id-1953646535163376341790981412">
<ds:Transforms>
<ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
<ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#">
<ec:InclusiveNamespaces PrefixList="xs" xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#"/>
</ds:Transform>
</ds:Transforms>
<ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
<ds:DigestValue>LJB8M4xyo6TEjYzoJ+8icyMM5N8ix1jbXFiBPrU+NB0=</ds:DigestValue>
</ds:Reference>
</ds:SignedInfo>
<ds:SignatureValue></ds:SignatureValue>
<ds:KeyInfo>
<ds:X509Data>
<ds:X509Certificate></ds:X509Certificate>
</ds:X509Data>
</ds:KeyInfo>
</ds:Signature>
<saml2:Subject xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">
<saml2:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress">**redacted was the correct email address with mixed case and matches the user table in znuny exactly**</saml2:NameID>
<saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
<saml2:SubjectConfirmationData InResponseTo="NETSAML2_3031e2d384b7998789b7e26035ff0b82819afe6e9ac5a97ea1ebe5cbaf35bdc2" NotOnOrAfter="2026-10-15T18:59:07.147Z" Recipient="**redacted**/index.pl?Action=Login"/>
</saml2:SubjectConfirmation>
</saml2:Subject>
<saml2:Conditions NotBefore="2026-10-15T18:49:07.147Z" NotOnOrAfter="2026-10-15T18:59:07.147Z" xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">
<saml2:AudienceRestriction>
<saml2:Audience>**redacted**</saml2:Audience>
</saml2:AudienceRestriction>
</saml2:Conditions>
<saml2:AuthnStatement AuthnInstant="2026-10-15T18:54:07.147Z" SessionIndex="NETSAML2_3031e2d384b7998789b7e26035ff0b82819afe6e9ac5a97ea1ebe5cbaf35bdc2" xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">
<saml2:AuthnContext>
<saml2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml2:AuthnContextClassRef>
</saml2:AuthnContext>
</saml2:AuthnStatement>
<saml2:AttributeStatement xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">
<saml2:Attribute Name="givenname" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified">
<saml2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">**redacted -- was the correct first name, first letter uppercase the rest lower**</saml2:AttributeValue>
</saml2:Attribute>
<saml2:Attribute Name="surname" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified">
<saml2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">**redacted -- was the correct last name, first letter uppercase the rest lower**</saml2:AttributeValue>
</saml2:Attribute>
<saml2:Attribute Name="emailaddress" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified">
<saml2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">**redacted was the correct email address with mixed case and matches the user table in znuny exactly**</saml2:AttributeValue>
</saml2:Attribute>
<saml2:Attribute Name="uid" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified">
<saml2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">**redacted was the correct email address with mixed case and matches the user table in znuny exactly**</saml2:AttributeValue>
</saml2:Attribute>
<saml2:Attribute Name="login" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified">
<saml2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">**redacted was the correct email address with mixed case and matches the user table in znuny exactly**</saml2:AttributeValue>
</saml2:Attribute>
</saml2:AttributeStatement>
</saml2:Assertion>
</saml2p:Response>

[wvotta]

I removed the certs and sigs from the SAML inspection.

What am I doing wrong here?

[wvotta]

FYI, in Okta we've set Name ID format: EmailAddress