KB440571: SAML login shows HTTP 500 error in MicroStrategy Library when using Okta as the IDP

SYMPTOM:

After setting up 10.11 Strategy Library with SAML login using Okta as the Identity Provider, user will encounter HTTP 500 error page when clicking on the "SAML" button from the Library login page.

CAUSE:

This is a known issue in Strategy Library 10.11.
 
In 10.11 Library, SAML request in HTTP-POST binding format fails due to missing dependencies. Okta by default is asking service providers to initiate SAML authentication request in HTTP-POST first and thus the Library app errors out. The error should only happen in SP initiated SAML login scenario (where SAML login is initiated by clicking the button from Library login page); while IDP initiated login should not be affected. Also it is not only limited to Okta. Any IDP whose IDPMetadata.xml that puts "HTTP-POST" binding method first for the SingleSignOnService would have the same issue.

 

WORKAROUND:
To workaround this issue in Strategy Library 10.11, disable HTTP-POST method IDPMetadata.xml as described below:
1. Locate IDPMetadata.xml at /WEB-INF/classes/auth/SAML of the Library installation folder
2. Open IDPMetadata.xml in Notepad editor and comment out the following XML tag as shown below

<!--
<md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="URL"/>
-->

3. Make sure the alternative "HTTP-Redirect" SingleSignOnService is still in place
4. Save IDPMetadata.xml and restart web server
 

ACTION:

This issue has been fixed in Strategy Library 11.0. Upgrade to take advantage of the fix.
KB440571