https://www.ory.sh/ logo
Join SlackCommunities
Powered by
<@U04UQ68083H> I get the following error when usin...
# ory-copilot
b
@chilly-king-10285 I get the following error when using a SAML integration in Ory. My IdP is Okta. This is after I've been redirected to Okta. I am running locally with ory tunnel. I have a similar configuration for OIDC that works
Copy code
{
  "id": "aa3496fc-370a-4db2-8ed0-1d0467573690",
  "error": {
    "code": 400,
    "debug": "key ory_kratos_oidc_auth_code_session does not exist in cookie: ory_kratos_continuity\<http://ngithub.com/ory/kratos/x.SessionGetString.func1|ngithub.com/ory/kratos/x.SessionGetString.func1>\n\<http://tgithub.com/ory/kratos@v1.3.1-0.20250407104818-53e733b5f005/x/cookie.go:31|tgithub.com/ory/kratos@v1.3.1-0.20250407104818-53e733b5f005/x/cookie.go:31>\<http://ngithub.com/ory/kratos/x.SessionGetString|ngithub.com/ory/kratos/x.SessionGetString>\n\<http://tgithub.com/ory/kratos@v1.3.1-0.20250407104818-53e733b5f005/x/cookie.go:50|tgithub.com/ory/kratos@v1.3.1-0.20250407104818-53e733b5f005/x/cookie.go:50>\<http://ngithub.com/ory/kratos/continuity.(*ManagerCookie).sessionID|ngithub.com/ory/kratos/continuity.(*ManagerCookie).sessionID>\n\<http://tgithub.com/ory/kratos@v1.3.1-0.20250407104818-53e733b5f005/continuity/manager_cookie.go:119|tgithub.com/ory/kratos@v1.3.1-0.20250407104818-53e733b5f005/continuity/manager_cookie.go:119>\<http://ngithub.com/ory/kratos/continuity.(*ManagerCookie).container|ngithub.com/ory/kratos/continuity.(*ManagerCookie).container>\n\<http://tgithub.com/ory/kratos@v1.3.1-0.20250407104818-53e733b5f005/continuity/manager_cookie.go:135|tgithub.com/ory/kratos@v1.3.1-0.20250407104818-53e733b5f005/continuity/manager_cookie.go:135>\<http://ngithub.com/ory/kratos/continuity.(*ManagerCookie).Continue|ngithub.com/ory/kratos/continuity.(*ManagerCookie).Continue>\n\<http://tgithub.com/ory/kratos@v1.3.1-0.20250407104818-53e733b5f005/continuity/manager_cookie.go:77|tgithub.com/ory/kratos@v1.3.1-0.20250407104818-53e733b5f005/continuity/manager_cookie.go:77>\<http://ngithub.com/ory/kratos/selfservice/strategy/oidc.(*Strategy).ValidateCallback|ngithub.com/ory/kratos/selfservice/strategy/oidc.(*Strategy).ValidateCallback>\n\<http://tgithub.com/ory/kratos@v1.3.1-0.20250407104818-53e733b5f005/selfservice/strategy/oidc/strategy.go:372|tgithub.com/ory/kratos@v1.3.1-0.20250407104818-53e733b5f005/selfservice/strategy/oidc/strategy.go:372>\<http://ngithub.com/ory/kratos/selfservice/strategy/oidc.(*Strategy).HandleCallback|ngithub.com/ory/kratos/selfservice/strategy/oidc.(*Strategy).HandleCallback>\n\<http://tgithub.com/ory/kratos@v1.3.1-0.20250407104818-53e733b5f005/selfservice/strategy/oidc/strategy.go:453|tgithub.com/ory/kratos@v1.3.1-0.20250407104818-53e733b5f005/selfservice/strategy/oidc/strategy.go:453>\<http://ngithub.com/ory-corp/cloud/kratos/kratos/internal/saml.(*Strategy).HandleCallback|ngithub.com/ory-corp/cloud/kratos/kratos/internal/saml.(*Strategy).HandleCallback>\n\<http://tgithub.com/ory-corp/cloud/kratos/kratos/internal/saml/saml_strategy.go:63|tgithub.com/ory-corp/cloud/kratos/kratos/internal/saml/saml_strategy.go:63>\<http://ngithub.com/ory/kratos/selfservice/strategy.disabledWriter|ngithub.com/ory/kratos/selfservice/strategy.disabledWriter>\n\<http://tgithub.com/ory/kratos@v1.3.1-0.20250407104818-53e733b5f005/selfservice/strategy/handler.go:28|tgithub.com/ory/kratos@v1.3.1-0.20250407104818-53e733b5f005/selfservice/strategy/handler.go:28>\<http://ngithub.com/ory-corp/cloud/kratos/kratos/internal/saml.(*Strategy).setRoutes.IsDisabled.func1|ngithub.com/ory-corp/cloud/kratos/kratos/internal/saml.(*Strategy).setRoutes.IsDisabled.func1>\n\<http://tgithub.com/ory/kratos@v1.3.1-0.20250407104818-53e733b5f005/selfservice/strategy/handler.go:33|tgithub.com/ory/kratos@v1.3.1-0.20250407104818-53e733b5f005/selfservice/strategy/handler.go:33>\<http://ngithub.com/ory/kratos/x.(*RouterPublic).GET.NoCacheHandle.func1|ngithub.com/ory/kratos/x.(*RouterPublic).GET.NoCacheHandle.func1>\n\<http://tgithub.com/ory/kratos@v1.3.1-0.20250407104818-53e733b5f005/x/nocache.go:21|tgithub.com/ory/kratos@v1.3.1-0.20250407104818-53e733b5f005/x/nocache.go:21>\<http://ngithub.com/ory/kratos/x.(*RouterPublic).Handle.NoCacheHandle.func1|ngithub.com/ory/kratos/x.(*RouterPublic).Handle.NoCacheHandle.func1>\n\<http://tgithub.com/ory/kratos@v1.3.1-0.20250407104818-53e733b5f005/x/nocache.go:21|tgithub.com/ory/kratos@v1.3.1-0.20250407104818-53e733b5f005/x/nocache.go:21>\<http://ngithub.com/julienschmidt/httprouter.(*Router).ServeHTTP|ngithub.com/julienschmidt/httprouter.(*Router).ServeHTTP>\n\<http://tgithub.com/julienschmidt/httprouter@v1.3.0/router.go:387|tgithub.com/julienschmidt/httprouter@v1.3.0/router.go:387>\<http://ngithub.com/ory/nosurf.(*CSRFHandler).handleSuccess|ngithub.com/ory/nosurf.(*CSRFHandler).handleSuccess>\n\<http://tgithub.com/ory/nosurf@v1.2.7/handler.go:212|tgithub.com/ory/nosurf@v1.2.7/handler.go:212>\<http://ngithub.com/ory/nosurf.(*CSRFHandler).ServeHTTP|ngithub.com/ory/nosurf.(*CSRFHandler).ServeHTTP>\n\<http://tgithub.com/ory/nosurf@v1.2.7/handler.go:169|tgithub.com/ory/nosurf@v1.2.7/handler.go:169>\<http://ngithub.com/ory/kratos/cmd/daemon.servePublic.MaxBytesHandler.func4|ngithub.com/ory/kratos/cmd/daemon.servePublic.MaxBytesHandler.func4>\n\tnet/http/server.go:4055\nnet/http.HandlerFunc.ServeHTTP\n\tnet/http/server.go:2294\<http://ngithub.com/urfave/negroni.(*Negroni).UseHandler.Wrap.func1|ngithub.com/urfave/negroni.(*Negroni).UseHandler.Wrap.func1>\n\<http://tgithub.com/urfave/negroni@v1.0.0/negroni.go:46|tgithub.com/urfave/negroni@v1.0.0/negroni.go:46>\<http://ngithub.com/urfave/negroni.HandlerFunc.ServeHTTP|ngithub.com/urfave/negroni.HandlerFunc.ServeHTTP>\n\<http://tgithub.com/urfave/negroni@v1.0.0/negroni.go:29|tgithub.com/urfave/negroni@v1.0.0/negroni.go:29>\<http://ngithub.com/urfave/negroni.middleware.ServeHTTP|ngithub.com/urfave/negroni.middleware.ServeHTTP>\n\<http://tgithub.com/urfave/negroni@v1.0.0/negroni.go:38|tgithub.com/urfave/negroni@v1.0.0/negroni.go:38>\<http://ngithub.com/ory/kratos/x.init.func1|ngithub.com/ory/kratos/x.init.func1>\n\<http://tgithub.com/ory/kratos@v1.3.1-0.20250407104818-53e733b5f005/x/clean_url.go:15|tgithub.com/ory/kratos@v1.3.1-0.20250407104818-53e733b5f005/x/clean_url.go:15>\<http://ngithub.com/urfave/negroni.HandlerFunc.ServeHTTP|ngithub.com/urfave/negroni.HandlerFunc.ServeHTTP>\n\<http://tgithub.com/urfave/negroni@v1.0.0/negroni.go:29|tgithub.com/urfave/negroni@v1.0.0/negroni.go:29>\<http://ngithub.com/urfave/negroni.middleware.ServeHTTP|ngithub.com/urfave/negroni.middleware.ServeHTTP>\n\<http://tgithub.com/urfave/negroni@v1.0.0/negroni.go:38|tgithub.com/urfave/negroni@v1.0.0/negroni.go:38>\<http://ngithub.com/ory/kratos/cmd/daemon.servePublic.func1|ngithub.com/ory/kratos/cmd/daemon.servePublic.func1>\n\<http://tgithub.com/ory/kratos@v1.3.1-0.20250407104818-53e733b5f005/cmd/daemon/serve.go:106|tgithub.com/ory/kratos@v1.3.1-0.20250407104818-53e733b5f005/cmd/daemon/serve.go:106>\<http://ngithub.com/urfave/negroni.HandlerFunc.ServeHTTP|ngithub.com/urfave/negroni.HandlerFunc.ServeHTTP>\n\<http://tgithub.com/urfave/negroni@v1.0.0/negroni.go:29|tgithub.com/urfave/negroni@v1.0.0/negroni.go:29>\<http://ngithub.com/urfave/negroni.middleware.ServeHTTP|ngithub.com/urfave/negroni.middleware.ServeHTTP>\n\<http://tgithub.com/urfave/negroni@v1.0.0/negroni.go:38|tgithub.com/urfave/negroni@v1.0.0/negroni.go:38>\nnet/http.HandlerFunc.ServeHTTP\n\tnet/http/server.go:2294\<http://ngithub.com/prometheus/client_golang/prometheus/promhttp.InstrumentHandlerResponseSize.func1|ngithub.com/prometheus/client_golang/prometheus/promhttp.InstrumentHandlerResponseSize.func1>\n\<http://tgithub.com/prometheus/client_golang@v1.21.1/prometheus/promhttp/instrument_server.go:296|tgithub.com/prometheus/client_golang@v1.21.1/prometheus/promhttp/instrument_server.go:296>\nnet/http.HandlerFunc.ServeHTTP\n\tnet/http/server.go:2294\<http://ngithub.com/prometheus/client_golang/prometheus/promhttp.InstrumentHandlerCounter.func1|ngithub.com/prometheus/client_golang/prometheus/promhttp.InstrumentHandlerCounter.func1>\n\<http://tgithub.com/prometheus/client_golang@v1.21.1/prometheus/promhttp/instrument_server.go:147|tgithub.com/prometheus/client_golang@v1.21.1/prometheus/promhttp/instrument_server.go:147>\nnet/http.HandlerFunc.ServeHTTP\n\tnet/http/server.go:2294\<http://ngithub.com/prometheus/client_golang/prometheus/promhttp.InstrumentHandlerDuration.func1|ngithub.com/prometheus/client_golang/prometheus/promhttp.InstrumentHandlerDuration.func1>\n\<http://tgithub.com/prometheus/client_golang@v1.21.1/prometheus/promhttp/instrument_server.go:97|tgithub.com/prometheus/client_golang@v1.21.1/prometheus/promhttp/instrument_server.go:97>",
    "message": "no resumable session found",
    "reason": "The browser does not contain the necessary cookie to resume the session. This is a security violation and was blocked. Please clear your browser's cookies and cache and try again!",
    "status": "Bad Request"
  },
  "created_at": "2025-04-09T20:52:21.048379Z",
  "updated_at": "2025-04-09T20:52:21.048379Z"
}
b
A message from kapa.ai
Based on the error message you're seeing, it appears you're encountering a cookie-related issue with your SAML integration in Ory. The error indicates that the 
ory_kratos_continuity
cookie is missing or doesn't contain the expected session data when you're redirected back from Okta. This is a common issue when working with Ory's authentication flows locally, especially when using the Ory Tunnel. Let me explain some potential causes and solutions: ## Possible causes 1. Cookie domain issues: The 
ory_kratos_continuity
cookie might be set on a different domain than where your application is running. Unlike other Ory cookies, this continuity cookie doesn't have a configurable domain setting. 2. Mixing localhost and 127.0.0.1: If you're using both 
localhost
and 
127.0.0.1
interchangeably in your setup, this can cause cookie problems as browsers treat them as different domains. 3. Cookie persistence settings: The session cookie persistence settings might be affecting how the continuity cookie works. ## Solutions to try 1. Be consistent with domains: Make sure you're consistently using either 
localhost
or 
127.0.0.1
throughout your application and Ory configuration, but not both interchangeably. This is mentioned in the [CSRF troubleshooting documentation](https://www.ory.sh/docs/kratos/debug/csrf): > Make sure that the domain stays the same. This is also true for 
127.0.0.1
and 
localhost
which are both separate domains. Make sure that you use 
127.0.0.1
or 
localhost
consistently across your configuration! 2. Check session persistence settings: Ensure that 
session.cookie.persistent
is enabled in your configuration. This was identified as a solution in a similar issue: > It's Kratos setting 
session.cookie.persistent
that makes the difference. In my clean "working" project it is undefined. In my old "broken" project it was explicitly 
false
. [Source](https://github.com/ory/network/issues/194) 3. Verify Ory Tunnel configuration: When using Ory Tunnel for local development, make sure you're running it with the 
--dev
flag:
Copy code
ory tunnel --dev --project $PROJECT_SLUG <http://localhost:3000>
The 
--dev
flag disables some security checks that might be causing issues with cookies during local development [as mentioned in the documentation](https://www.ory.sh/docs/getting-started/local-development#local-development). 4. Check browser cookie settings: Some browsers (like Brave) have strict cookie policies that might be affecting your flow. Try using Chrome or Firefox with default settings. 5. Ensure proper cookie forwarding: If you're using a backend to proxy requests, make sure it's correctly forwarding all cookies to the Ory API. This issue is known and there's an open GitHub issue about the 
ory_kratos_continuity
cookie not having a configurable domain setting, which can cause problems in multi-domain setups: [GitHub Issue #2713](https://github.com/ory/kratos/issues/2713). If these solutions don't resolve your issue, you might want to check your browser's developer tools to inspect the cookies being set and sent during the authentication flow to identify exactly where the problem is occurring.
Open in Slack
PreviousNext
Powered by