title: authenticate to SharePoint through OKTA from back-end service
body: <p>I have a need to programmatically connect to a customer's SharePoint server that uses OKTA for authentication.  I saw this <a href="https://stackoverflow.com/questions/35233948">post</a> which looked promising, but cannot seem to get a valid session cookie back from OKTA.</p>
  
  <p>I can successfully call the /api/v1/authn endpoint and get back a sessionToken, but when I turn around and call /api/v1/sessions?additionalFields=cookieToken with that session token, I always received a 403 - Forbidden, with the following json:</p>
  
  <pre><code>{ 
  "errorCode": "E0000005", 
  "errorSummary": "Invalid Session", 
  "errorLink": "E0000005", 
  "errorId": "oaew0udr2ElRfCnZvBFt075SA", 
  "errorCauses": [] 
  }
  </code></pre>
  
  <p>Assuming I can get this resolved, I'm not sure of the URL I should call with the cookieToken.  Is the url an OKTA endpoint that will redirect to SharePoint or is it an SharePoint endpoint that will setup the session with the cookie?</p>
  
  <p><strong>Update:</strong>
  I am able to call this okta endpoint -> /api/v1/sessions?additionalFields=cookieToken with my user credentials as json</p>
  
  <pre><code>{ 
  "username": "user@email.com",
  "password": "P@ssw0rd"
  }
  </code></pre>
  
  <p>And am able to retrieve a one-time cookie token that can be used with this link to start a SAML session in a browser:</p>
  
  <pre><code>https://[mydomain].okta.com/login/sessionCookieRedirect?redirectUrl=[sharepoint site url]&amp;token=[cookie token]
  </code></pre>
  
  <p>That works in a browser, the user is automatically authenticated and ends up in SharePoint.  However, it seems that this session "setup" is at least partly achieved through javascript as executing the same link in a programmatic HTTP client (such as Apache HTTP Client) does not work.  The http client is sent through a couple of redirects and ends up in the SharePoint site, but the user is not authenticated.  The response is 403 - Forbidden with the following headers:</p>
  
  <p>403 - FORBIDDEN</p>
  
  <pre><code>Content-Type -&gt; text/plain; charset=utf-8
  Server -&gt; Microsoft-IIS/8.5
  X-SharePointHealthScore -&gt; 0
  SPRequestGuid -&gt; 0ecd7b9d-c346-9081-cac4-43e41f3b159a
  request-id -&gt; 0ecd7b9d-c346-9081-cac4-43e41f3b159a
  X-Forms_Based_Auth_Required -&gt; https://[sharepoint site]/_login/autosignin.aspx?ReturnUrl=/_layouts/15/error.aspx
  X-Forms_Based_Auth_Return_Url -&gt; https://[sharepoint site]/_layouts/15/error.aspx
  X-MSDAVEXT_Error -&gt; 917656; Access denied. Before opening files in this location, you must first browse to the web site and select the option to login automatically.
  X-Powered-By -&gt; ASP.NET
  MicrosoftSharePointTeamServices -&gt; 15.0.0.4709
  X-Content-Type-Options -&gt; nosniff
  X-MS-InvokeApp -&gt; 1; RequireReadOnly
  Date -&gt; Fri, 13 May 2016 15:02:38 GMT
  Content-Length -&gt; 13
  </code></pre>
  
  <p>I'm starting to wonder if this is a lost cause, that OKTA or SharePoint doesn't support programmatic authentication via SAML.</p>