title: Kentor Auth Services integration with Okta
body: <p>I am using [Kentor Auth Services][1] [HttpModule][2] to integrate with our application using Okta as IdP. I can get the SampleApplication to work with Okta and when I try the same configuration through web.config after installing Kentor Auth Services through NuGet, nothing happens, just presented with the login screen to enter credentials even if I log into Okta and come to the app from there.</p>
  
  <p>The Web.config is as below:</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="utf-8"?&gt;
  &lt;configuration&gt;
   &lt;configSections&gt;
      &lt;sectionGroup name="system.web.extensions" type="System.Web.Configuration.SystemWebExtensionsSectionGroup,     System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35"&gt;
        &lt;sectionGroup name="scripting" type="System.Web.Configuration.ScriptingSectionGroup, System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35"&gt;
          &lt;sectionGroup name="webServices" type="System.Web.Configuration.ScriptingWebServicesSectionGroup, System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35"&gt;
          &lt;/sectionGroup&gt;
        &lt;/sectionGroup&gt;
      &lt;/sectionGroup&gt;
      &lt;section name="system.identityModel" type="System.IdentityModel.Configuration.SystemIdentityModelSection, System.IdentityModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=B77A5C561934E089" /&gt;
  &lt;section name="system.identityModel.services" type="System.IdentityModel.Services.Configuration.SystemIdentityModelServicesSection, System.IdentityModel.Services, Version=4.0.0.0, Culture=neutral, PublicKeyToken=B77A5C561934E089" /&gt;
  &lt;section name="kentor.authServices" type="Kentor.AuthServices.Configuration.KentorAuthServicesSection, Kentor.AuthServices" /&gt;
  &lt;section name="log4net" type="log4net.Config.Log4NetConfigurationSectionHandler, log4net" /&gt;
    &lt;/configSections&gt;
    &lt;connectionStrings&gt;
  &lt;add name="Databasepsdb1" connectionString="Data Source=SQL_SERVER;Database=MYDATABASE;Trusted_Connection=no;User Id=USER_ID;Password=USER_PASSWORD" providerName="System.Data.SqlClient" /&gt;
  &lt;/connectionStrings&gt;
  &lt;appSettings&gt;
  &lt;add key="LogDatabaseCommands" value="false" /&gt;
  &lt;add key="LogDatabaseExceptions" value="default" /&gt;
  &lt;add key="LogCommitExceptions" value="default" /&gt;
  &lt;add key="TraceDatabaseCommands" value="false" /&gt;
  &lt;add key="TraceDataAccessMethods" value="false" /&gt;
  &lt;add key="TraceTransactionCache" value="false" /&gt;
  &lt;add key="ViewStateLocation" value="Page" /&gt;
  &lt;add key="WebServer" value="http://localhost" /&gt;
  &lt;add key="DefaultPageUrl" value="MyPages/MyPage.aspx" /&gt;
  &lt;add key="FCKeditor:BasePath" value="~/FCKeditor/" /&gt;
  &lt;add key="ApplicationName" value="MyPages" /&gt;
  &lt;add key="CookieEncryptionKey" value="SOME VALUE" /&gt;
  &lt;add key="URLEncryptionKey" value="SOME VALUE" /&gt;
  &lt;add key="LogEvents" value="false" /&gt;
  &lt;add key="ShowAutoSignInCheckBox" value="False" /&gt;
  &lt;add key="ShowRememberPasswordCheckBox" value="False" /&gt;
  &lt;add key="ShowRememberUserCheckBox" value="False" /&gt;
  &lt;add key="SignedOutPageUrl" value="Security/SignOut.aspx" /&gt;
  &lt;add key="SignInPageUrl" value="Security/SignIn.aspx" /&gt;
  &lt;add key="AuthenticationType" value="ProprietorySecurity" /&gt;
  &lt;add key="RoleManagement" value="ProprietoryRoles" /&gt;
  &lt;add key="SearchNestedGroups" value="False" /&gt;
  &lt;add key="SecurityDisabled" value="False" /&gt;
  &lt;add key="UserIdentityTable" value="My.App.Payslips.Business.UsersTable, App_Code" /&gt;
  &lt;add key="log4net.Config" value="log4net.config" /&gt;
  &lt;add key="log4net.Config.Watch" value="True" /&gt;
  &lt;add key="webpages:Version" value="2.0.0.0" /&gt;
  &lt;add key="webpages:Enabled" value="false" /&gt;
  &lt;add key="PreserveLoginUrl" value="true" /&gt;
  &lt;add key="ClientValidationEnabled" value="true" /&gt;
  &lt;add key="UnobtrusiveJavaScriptEnabled" value="true" /&gt;
   &lt;/appSettings&gt;
   &lt;system.web&gt;
  &lt;roleManager enabled="false" cacheRolesInCookie="false" defaultProvider="AspNetSqlRoleProvider" /&gt;
  &lt;siteMap defaultProvider="AspNetXmlSiteMapProvider" /&gt;
  &lt;compilation debug="true" targetFramework="4.5"&gt;
    &lt;assemblies&gt;
      &lt;add assembly="Microsoft.IdentityModel, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35" /&gt;
      &lt;add assembly="System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35" /&gt;
      &lt;add assembly="System.Core, Version=3.5.0.0, Culture=neutral, PublicKeyToken=B77A5C561934E089" /&gt;
      &lt;add assembly="System.Xml.Linq, Version=3.5.0.0, Culture=neutral, PublicKeyToken=B77A5C561934E089" /&gt;
      &lt;add assembly="System.Data.DataSetExtensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=B77A5C561934E089" /&gt;
    &lt;/assemblies&gt;
  &lt;/compilation&gt;
  &lt;httpModules&gt;
    &lt;add name="AntiXssModule" type="Microsoft.Security.Application.SecurityRuntimeEngine.AntiXssModule" /&gt;
    &lt;add name="ClaimsPrincipalHttpModule" type="Microsoft.IdentityModel.Web.ClaimsPrincipalHttpModule, Microsoft.IdentityModel, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" /&gt;
    &lt;add name="ScriptModule" type="System.Web.Handlers.ScriptModule, System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35" /&gt;
  &lt;/httpModules&gt;
  &lt;pages validateRequest="false" theme="My.App"&gt;
    &lt;namespaces&gt;
      &lt;clear /&gt;
      &lt;add namespace="My.App.Payslips" /&gt;
      &lt;add namespace="My.App.Payslips.UI" /&gt;
      &lt;add namespace="My.App.Payslips.UI.Controls" /&gt;
      &lt;add namespace="My.App.Payslips.Data" /&gt;
      &lt;add namespace="My.App.Payslips.Business" /&gt;
      &lt;add namespace="System" /&gt;
      &lt;add namespace="System.Collections" /&gt;
      &lt;add namespace="System.Collections.Specialized" /&gt;
      &lt;add namespace="System.Configuration" /&gt;
      &lt;add namespace="System.Text" /&gt;
      &lt;add namespace="System.Text.RegularExpressions" /&gt;
      &lt;add namespace="System.Web" /&gt;
      &lt;add namespace="System.Web.Caching" /&gt;
      &lt;add namespace="System.Web.SessionState" /&gt;
      &lt;add namespace="System.Web.Security" /&gt;
      &lt;add namespace="System.Web.Profile" /&gt;
      &lt;add namespace="System.Web.UI" /&gt;
      &lt;add namespace="System.Web.UI.WebControls" /&gt;
      &lt;add namespace="System.Web.UI.WebControls.WebParts" /&gt;
      &lt;add namespace="System.Web.UI.HtmlControls" /&gt;
      &lt;add namespace="BaseClasses" /&gt;
      &lt;add namespace="BaseClasses.Web.UI.WebControls" /&gt;
      &lt;add namespace="System.Web.Helpers" /&gt;
      &lt;add namespace="System.Web.Mvc" /&gt;
      &lt;add namespace="System.Web.Mvc.Ajax" /&gt;
      &lt;add namespace="System.Web.Mvc.Html" /&gt;
      &lt;add namespace="System.Web.Optimization" /&gt;
      &lt;add namespace="System.Web.Routing" /&gt;
      &lt;add namespace="System.Web.WebPages" /&gt;
    &lt;/namespaces&gt;
    &lt;tagMapping&gt;
      &lt;add tagType="System.Web.UI.WebControls.CompareValidator" mappedTagType="Sample.Web.UI.Compatibility.CompareValidator, Validators, Version=1.0.0.0" /&gt;
      &lt;add tagType="System.Web.UI.WebControls.CustomValidator" mappedTagType="Sample.Web.UI.Compatibility.CustomValidator, Validators, Version=1.0.0.0" /&gt;
      &lt;add tagType="System.Web.UI.WebControls.RangeValidator" mappedTagType="Sample.Web.UI.Compatibility.RangeValidator, Validators, Version=1.0.0.0" /&gt;
      &lt;add tagType="System.Web.UI.WebControls.RegularExpressionValidator" mappedTagType="Sample.Web.UI.Compatibility.RegularExpressionValidator, Validators, Version=1.0.0.0" /&gt;
      &lt;add tagType="System.Web.UI.WebControls.RequiredFieldValidator" mappedTagType="Sample.Web.UI.Compatibility.RequiredFieldValidator, Validators, Version=1.0.0.0" /&gt;
      &lt;add tagType="System.Web.UI.WebControls.ValidationSummary" mappedTagType="Sample.Web.UI.Compatibility.ValidationSummary, Validators, Version=1.0.0.0" /&gt;
    &lt;/tagMapping&gt;
    &lt;controls&gt;
      &lt;add tagPrefix="asp" namespace="System.Web.UI" assembly="System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35" /&gt;
      &lt;add tagPrefix="asp" namespace="System.Web.UI.WebControls" assembly="System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35" /&gt;
      &lt;add assembly="Microsoft.AspNet.Web.Optimization.WebForms" namespace="Microsoft.AspNet.Web.Optimization.WebForms" tagPrefix="webopt" /&gt;
    &lt;/controls&gt;
  &lt;/pages&gt;
  &lt;customErrors mode="RemoteOnly" defaultRedirect="Shared/Internal_Server_Error.html"&gt;
    &lt;error statusCode="404" redirect="Shared/Internal_Server_Error.html" /&gt;
    &lt;error statusCode="500" redirect="Shared/Internal_Server_Error.html" /&gt;
  &lt;/customErrors&gt;
  &lt;authentication mode="Forms" /&gt;
  &lt;authorization&gt;
    &lt;allow users="*" /&gt;
  &lt;/authorization&gt;
  &lt;trace enabled="false" requestLimit="10" pageOutput="false" traceMode="SortByTime" localOnly="true" /&gt;
  &lt;sessionState mode="InProc" stateConnectionString="tcpip=127.0.0.1:42424" sqlConnectionString="data source=127.0.0.1;user id=sa;password=" cookieless="false" timeout="60" /&gt;
  &lt;globalization fileEncoding="utf-8" requestEncoding="utf-8" responseEncoding="utf-8" culture="en-IE" uiCulture="en-IE" /&gt;
  &lt;httpRuntime maxRequestLength="102400" enableVersionHeader="false" executionTimeout="54000" /&gt;
  &lt;httpHandlers&gt;
    &lt;remove verb="*" path="*.asmx" /&gt;
    &lt;add verb="*" path="*.asmx" validate="false" type="System.Web.Script.Services.ScriptHandlerFactory, System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35" /&gt;
    &lt;add verb="*" path="*_AppService.axd" validate="false" type="System.Web.Script.Services.ScriptHandlerFactory, System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35" /&gt;
    &lt;add verb="GET,HEAD" path="ScriptResource.axd" validate="false" type="System.Web.Handlers.ScriptResourceHandler, System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35" /&gt;
  &lt;/httpHandlers&gt;
  &lt;/system.web&gt;
  &lt;location path="DefaultWsdlHelpGenerator.aspx"&gt;
  &lt;system.web&gt;
    &lt;pages styleSheetTheme="" /&gt;
  &lt;/system.web&gt;
  &lt;/location&gt;
  &lt;system.net&gt;
   &lt;mailSettings&gt;
       &lt;smtp from="Server@domain.com"&gt;
      &lt;network host="127.0.0.1" port="25" /&gt;
    &lt;/smtp&gt;
  &lt;/mailSettings&gt;
  &lt;/system.net&gt;
  &lt;system.codedom&gt;
    &lt;compilers&gt;
      &lt;compiler language="c#;cs;csharp" extension=".cs" type="Microsoft.CSharp.CSharpCodeProvider, System, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" warningLevel="4"&gt;
      &lt;providerOption name="CompilerVersion" value="v4.0" /&gt;
      &lt;providerOption name="WarnAsError" value="false" /&gt;
    &lt;/compiler&gt;
    &lt;!--
    &lt;compiler language="vb;vbs;visualbasic;vbscript" extension=".vb" type="Microsoft.VisualBasic.VBCodeProvider, System, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" warningLevel="4"&gt;
      &lt;providerOption name="CompilerVersion" value="v4.5.1" /&gt;
      &lt;providerOption name="OptionInfer" value="true" /&gt;
      &lt;providerOption name="WarnAsError" value="false" /&gt;
    &lt;/compiler&gt;
    --&gt;
  &lt;/compilers&gt;
  &lt;/system.codedom&gt;
   &lt;system.webServer&gt;
    &lt;validation validateIntegratedModeConfiguration="false" /&gt;
   &lt;modules&gt;
    &lt;remove name="ScriptModule" /&gt;
     &lt;add name="ScriptModule" preCondition="managedHandler" type="System.Web.Handlers.ScriptModule, System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35" /&gt;
    &lt;add name="SessionAuthenticationModule" type="System.IdentityModel.Services.SessionAuthenticationModule, System.IdentityModel.Services, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" /&gt;
    &lt;add name="Saml2AuthenticationModule" type="Kentor.AuthServices.HttpModule.Saml2AuthenticationModule, Kentor.AuthServices.HttpModule" /&gt;
  &lt;/modules&gt;
  &lt;handlers&gt;
    &lt;remove name="WebServiceHandlerFactory-Integrated" /&gt;
    &lt;remove name="ScriptHandlerFactory" /&gt;
    &lt;remove name="ScriptHandlerFactoryAppServices" /&gt;
    &lt;remove name="ScriptResource" /&gt;
    &lt;add name="ScriptHandlerFactory" verb="*" path="*.asmx" preCondition="integratedMode" type="System.Web.Script.Services.ScriptHandlerFactory, System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35" /&gt;
    &lt;add name="ScriptHandlerFactoryAppServices" verb="*" path="*_AppService.axd" preCondition="integratedMode" type="System.Web.Script.Services.ScriptHandlerFactory, System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35" /&gt;
    &lt;add name="ScriptResource" verb="GET,HEAD" path="ScriptResource.axd" preCondition="integratedMode" type="System.Web.Handlers.ScriptResourceHandler, System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35" /&gt;
  &lt;/handlers&gt;
   &lt;/system.webServer&gt;
   &lt;kentor.authServices entityId="https://subdomain.domain.com/aap1" returnUrl="https://subdomain.domain.com/aap1/" authenticateRequestSigningBehavior="Always"&gt;
  &lt;nameIdPolicy allowCreate="true" format="Persistent" /&gt;
  &lt;!--&lt;requestedAuthnContext classRef="Password" comparison="Minimum" /&gt;--&gt;
  &lt;identityProviders&gt;
    &lt;add entityId="http://www.okta.com/dfddusd45vad44fZ40h7" signOnUrl="https://dev-XXXXXX.oktapreview.com/app/MyAppdevXXXXXX_kentorauthserviceshttp_1/exk8dwyftyPFdCAZ40h7/sso/saml/" allowUnsolicitedAuthnResponse="true" binding="HttpRedirect"&gt;
      &lt;signingCertificate fileName="~/App_Data/okta.cer" /&gt;
    &lt;/add&gt;
  &lt;/identityProviders&gt;
  &lt;!--    
  &lt;federations&gt;
    &lt;add metadataLocation="~/App_Data/okta_metadata.xml" allowUnsolicitedAuthnResponse="true" /&gt;
  &lt;/federations&gt;
  --&gt;    
   &lt;/kentor.authServices&gt;
   &lt;system.identityModel.services&gt;
     &lt;federationConfiguration&gt;
    &lt;cookieHandler requireSsl="false" name="SampleApplicationAuth" /&gt;
  &lt;/federationConfiguration&gt;
    &lt;/system.identityModel.services&gt;
    &lt;runtime&gt;
      &lt;assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1" appliesTo="v2.0.50727"&gt;
    &lt;dependentAssembly&gt;
      &lt;assemblyIdentity name="AjaxControlToolkit" publicKeyToken="28f01b0e84b6d53e" /&gt;
      &lt;bindingRedirect oldVersion="1.0.0.0-1.1.0.0" newVersion="4.1.40412.0" /&gt;
    &lt;/dependentAssembly&gt;
    &lt;dependentAssembly&gt;
      &lt;assemblyIdentity name="System.Web.Extensions" publicKeyToken="31bf3856ad364e35" /&gt;
      &lt;bindingRedirect oldVersion="1.0.0.0-1.1.0.0" newVersion="3.5.0.0" /&gt;
    &lt;/dependentAssembly&gt;
    &lt;dependentAssembly&gt;
      &lt;assemblyIdentity name="System.Web.Extensions.Design" publicKeyToken="31bf3856ad364e35" /&gt;
      &lt;bindingRedirect oldVersion="1.0.0.0-1.1.0.0" newVersion="3.5.0.0" /&gt;
    &lt;/dependentAssembly&gt;
    &lt;dependentAssembly&gt;
      &lt;assemblyIdentity name="IKVM.Runtime" publicKeyToken="13235d27fcbfff58" culture="neutral" /&gt;
      &lt;bindingRedirect oldVersion="0.0.0.0-0.42.0.6" newVersion="0.42.0.6" /&gt;
    &lt;/dependentAssembly&gt;
    &lt;dependentAssembly&gt;
      &lt;assemblyIdentity name="EntityFramework" publicKeyToken="b77a5c561934e089" /&gt;
      &lt;bindingRedirect oldVersion="0.0.0.0-5.0.0.0" newVersion="5.0.0.0" /&gt;
    &lt;/dependentAssembly&gt;
    &lt;dependentAssembly&gt;
      &lt;assemblyIdentity name="WebGrease" publicKeyToken="31bf3856ad364e35" /&gt;
      &lt;bindingRedirect oldVersion="0.0.0.0-1.5.2.14234" newVersion="1.5.2.14234" /&gt;
    &lt;/dependentAssembly&gt;
    &lt;dependentAssembly&gt;
      &lt;assemblyIdentity name="System.Web.Helpers" publicKeyToken="31bf3856ad364e35" /&gt;
      &lt;bindingRedirect oldVersion="1.0.0.0-3.0.0.0" newVersion="3.0.0.0" /&gt;
    &lt;/dependentAssembly&gt;
    &lt;dependentAssembly&gt;
      &lt;assemblyIdentity name="System.Web.WebPages" publicKeyToken="31bf3856ad364e35" /&gt;
      &lt;bindingRedirect oldVersion="0.0.0.0-3.0.0.0" newVersion="3.0.0.0" /&gt;
    &lt;/dependentAssembly&gt;
    &lt;dependentAssembly&gt;
      &lt;assemblyIdentity name="System.Web.Razor" publicKeyToken="31bf3856ad364e35" culture="neutral" /&gt;
      &lt;bindingRedirect oldVersion="0.0.0.0-3.0.0.0" newVersion="3.0.0.0" /&gt;
    &lt;/dependentAssembly&gt;
    &lt;dependentAssembly&gt;
      &lt;assemblyIdentity name="System.Web.WebPages.Razor" publicKeyToken="31bf3856ad364e35" culture="neutral" /&gt;
      &lt;bindingRedirect oldVersion="0.0.0.0-3.0.0.0" newVersion="3.0.0.0" /&gt;
    &lt;/dependentAssembly&gt;
    &lt;dependentAssembly&gt;
      &lt;assemblyIdentity name="System.Web.Mvc" publicKeyToken="31bf3856ad364e35" /&gt;
      &lt;bindingRedirect oldVersion="1.0.0.0-5.2.2.0" newVersion="5.2.2.0" /&gt;
    &lt;/dependentAssembly&gt;
    &lt;dependentAssembly&gt;
      &lt;assemblyIdentity name="Antlr3.Runtime" publicKeyToken="eb42632606e9261f" culture="neutral" /&gt;
      &lt;bindingRedirect oldVersion="0.0.0.0-3.5.0.2" newVersion="3.5.0.2" /&gt;
    &lt;/dependentAssembly&gt;
    &lt;dependentAssembly&gt;
      &lt;assemblyIdentity name="Newtonsoft.Json" publicKeyToken="30ad4fe6b2a6aeed" culture="neutral" /&gt;
      &lt;bindingRedirect oldVersion="0.0.0.0-6.0.0.0" newVersion="6.0.0.0" /&gt;
    &lt;/dependentAssembly&gt;
  &lt;/assemblyBinding&gt;
    &lt;/runtime&gt;
  &lt;/configuration&gt;
  </code></pre>
  
  <p>Any help or direction will be highly appreciated.</p>
  
  <p><strong>EDIT</strong></p>
  
  <p>metadata</p>
  
  <pre><code>&lt;EntityDescriptor ID="_b3b47928-45ab-43b2-ab66-c7469701ff73" entityID="https://subdomain.domain.com/aap1" cacheDuration="PT1H" xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" xmlns="urn:oasis:names:tc:SAML:2.0:metadata"&gt;&lt;SPSSODescriptor AuthnRequestsSigned="true" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol"&gt;&lt;AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://subdomain.domain.com/aap1/AuthServices/Acs" index="0" isDefault="true" /&gt;&lt;AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact" Location="https://subdomain.domain.com/aap1/AuthServices/Acs" index="1" isDefault="false" /&gt;&lt;/SPSSODescriptor&gt;&lt;/EntityDescriptor&gt;
  </code></pre>