As an Okta admin, when you implement IWA, you have to know how to successfully test it to see if it's working. For this you:
Solution: Open up a command prompt and ping the Okta server handling the requests, information about the server found in Okta IP tables for your own org's Cell
In an SP-initiated SAML 2.0 flow, the SP will never redirect to Okta if the session is already active
Solution: It will always redirect to Okta and in this case only - will promt the user for re-authentication by manually entering Okta credentials
Any ...
Solution: Office 365 Global Administrator
In order for SAML to work, there is a need of an IDP and an SP and we know that already, but why is it so? Because:
Solution: An SP sends SAML assertions, while the IDP receives and validates them
After you turn on Desktop SSO, a default DSSO related routing rule is created. You must configure the network information for this rule.
Solution: You have nothing to do and even the rule is by default set to "Active"
In an SP-initiated SAML 2.0 flow, the SP will never redirect to Okta if the session is already active
Solution: It will always redirect to Okta and in this case only - will promt the user for re-authentication by manually entering SP credentials
As an Okta best-practice / recommendation: Okta encourages you to switch from Integrated Windows Authentication (IWA or DSSO) to agentless Desktop Single Sign-on (ADSSO). Okta is no longer adding new IWA functionality and offers only limited support and bug fixes.
Solution: Only the second statement is true
What does SCIM stand for?
Solution: System for CRSF-domain Identity Management
With agentless DSSO (Desktop Single Sign-on), you still have a need of deploying IWA Agents in your Active Directory domains to implement DSSO functionality.
Solution: The statement is true, as agentless DSSO means no AD agents, not no IWA agents
What does SCIM stand for?
Solution: System for Cross-domain Identity Management
