How to integrate OKTA with Azure App Service PaaS Webapp hosted Orchestrator?
Issue description:
While integrating OKTA with Orchestrator hosted as an Azure App Service, one might face certain certificate validation-related challenges.
In such a scenario, the following error is observed in Orchestrator -
"System.ArgumentException: Failed to configure SAML2 provider: 0. Error : SAML signing certificate 'CurrentUser\My:thumbprint=XXXXXXXXXXXXXXXXXXXXXXXX,ValidOnly' not found."
The following error is observed within the Identity app service -
ERROR - UiPath.IdentityServer.Authentication.Saml2.Saml2ProviderService Unable to configure signing certificate CurrentUser\My:thumbprint=XXXXXXXXX,ValidOnly for SAML provider with id 0 and issuer (null)....
Resolution:
- The OKTA certificate is delivered in a format that isn't inherently trusted. However, we have integrated a setting that bypasses this certificate validation process. This is particularly helpful while setting up the application on Azure App Service. It's important to note that the option to use 'WEBSITE_LOAD_ROOT_CERTIFICATES' is unavailable in a shared instance of Azure App Service and is only applicable in the App Service Environment (ASE).
- Follow the detailed instructions at Publish To Identity Server .
- In order to address this specific error and enable OKTA integration, it is required to modify the "App__Saml2ValidCertificateOnly" application setting in the Identity App Service. Set its value to "false". This action should ideally rectify this issue.
Note: This should work for any Orchestrator version where the parameter appears in the documentation. Check prior to attempting.