1 min lesson
SP-initiated vs IdP-initiated
Walk through "SP-initiated vs IdP-initiated" in order, then name the proof that tells you it worked.
Step 1 of 3
SP-initiated vs IdP-initiatedwhere the flow starts
The difference is just where the user begins. SP-initiated is the common, safer path; IdP-initiated skips the SP's request and is a frequent source of the dreaded "unsolicited response" error.
- 1SP-initiated. User hits the app, the SP redirects to the IdP with an
AuthnRequest, the IdP authenticates them, then POSTs a signed assertion back to the SP's ACS URL. - 2IdP-initiated. User clicks a tile in the Okta dashboard, the IdP POSTs an assertion to the SP cold - no prior
AuthnRequest. Apps that require a matching request will reject it as unsolicited.
Learn more
Full explanation
Inside the assertion
Inside the assertionthe fields you'll be asked to read
- Element
- NameID
- What it carries
- The user identifier the SP keys on (email, UPN, persistent ID)
- Why it breaks logins
- Format mismatch means the SP can't find the account
- Element
- AttributeStatement
- What it carries
- Claims: groups, first/last name, department
- Why it breaks logins
- Wrong attribute names break role mapping and JIT user creation
- Element
- Conditions / Audience
- What it carries
- Who the assertion is valid for + NotBefore/NotOnOrAfter
- Why it breaks logins
- Audience ≠ SP entity ID or clock skew, voids it
- Element
- Signature
- What it carries
- The IdP's signature over the assertion or response
- Why it breaks logins
- Rotated/expired cert means signature validation fails
| Element | What it carries | Why it breaks logins |
|---|---|---|
| NameID | The user identifier the SP keys on (email, UPN, persistent ID) | Format mismatch means the SP can't find the account |
| AttributeStatement | Claims: groups, first/last name, department | Wrong attribute names break role mapping and JIT user creation |
| Conditions / Audience | Who the assertion is valid for + NotBefore/NotOnOrAfter | Audience ≠ SP entity ID or clock skew, voids it |
| Signature | The IdP's signature over the assertion or response | Rotated/expired cert means signature validation fails |
Decode a real assertion (base64 → XML) and you can point at the failing line.
Signing vs encryption
Signing proves the assertion came from the IdP and wasn't altered; it's mandatory. Encryption hides the assertion contents from the browser that relays it and is optional, used when attributes are sensitive. Most break-fix work is signature-related, because certificates expire and rotate.
Learn more
Full explanation
The troubleshooting tree
The troubleshooting treesay this structure out loud
Interactive diagram. Step through it with the Next and Previous controls below, or Tab to a region to read its detail.
Narrate this order; the signature/cert check is the gate that catches whole-app outages.
Certificate rotation is the outage that wakes you up. When an Okta app's signing cert rolls (or the SP rotates theirs), every login fails at signature validation until both sides hold the new cert. In the interview, naming "rotated signing certificate" first when an entire app goes dark signals you've actually run this in production.
When handed "user can't SSOSingle Sign-On. One company login (usually via SAML or OIDC) instead of a separate password per tool. Press Enter for the full definition. into Zoom," don't guess a cause - narrate the tree. "First I'd check if it's one user or all of them, then pull the SAMLSecurity Assertion Markup Language. The XML-era enterprise standard that powers single sign-on: your identity provider vouches for you to each app. Older than OIDC but still what many enterprise tools speak. Press Enter for the full definition. trace and decode the assertion." The structure is what they're grading; a candidate who jumps straight to "probably the cert" looks lucky, not rigorous.
Learn more
Optional practice
Practice: SP-initiated vs IdP-initiated
QAn entire app's SSOSingle Sign-On. One company login (usually via SAML or OIDC) instead of a separate password per tool. Press Enter for the full definition. breaks at once - every user gets a signature-validation error. What's the most likely cause?
Learn more
Optional practice