Spring Boot 4 with SAML gives InResponseTo validation errors when logging in again after log out

3 days ago 2
ARTICLE AD BOX

I am using Spring Boot 4 with OpemSaml 5. i have set up for global log out with Okta. Both the log in and the log out works great. However, after a global logout if I try to log in again after an interval of 1 min - it gives the following error.

Authentication failed with provider OpenSaml5AuthenticationProvider since The response contained an InResponseTo attribute [ARQ5d86ec1-e795-49d6-9fd4-351dec0955f1] but no saved authentication request was found

If I try to login immediately (without waiting for a min), then the login works fine.

Here is the sequence of events.

I access the application url

The application redirects to Okta

I enter user credentials and after I login in, okta redirects to the application

Home page is shown. I do some activities in the app

I log out. This logs out of my App session and redirects to Okta for global logout

Okta logouts out on its end and redirects back to the application at Application Single logout end point

App then shows the standard logout screen with message (You have been signed out) and with a link to log into the app again

After 1 min, i click on the app link which restarts the log in process

But this time when I log in, it gives the following error

Authentication failed with provider OpenSaml5AuthenticationProvider since The response contained an InResponseTo attribute [ARQ5d86ec1-e795-49d6-9fd4-351dec0955f1] but no saved authentication request was found

After (8), my understanding is that the InResponseTo attribute should have been generated. But I am not sure why its not able to match when the response comes back.

Any thoughts ?

Read Entire Article