When the connection to Okta is unavailable, users can still sign in through Access Gateway and access SAML apps. Access Gateway uses the authentication service to authenticate users against your offline directory and issues a SAML assertion to the SP. For background on SAML, see Understanding SAML.
Configuring a SAML app involves establishing a mutual trust between Access Gateway, which acts as the IdP, and your client app, which acts as the SP. This is the typical flow when you configure a SAML app in Access Gateway:
- You provide the SP's entity ID and certificate to Access Gateway when you create the app. See Create the app.
- You define attributes to specify what user data Access Gateway includes in the SAML assertion that it sends to the SP. See Create attributes and configure the client app.
- Access Gateway returns its own IdP metadata for you to configure in the SP. See Configure your client app with Access Gateway IdP metadata.
You can only create and configure SAML apps in Access Gateway using the Access Gateway API. You can view SAML apps in the Access Gateway UI console, but you can't add or edit them there.