Error in setting up OSMT with internal SSO

[shitizz24]

Hi OSMT Team and github community,
I am trying to configure OSMT with internal SSO. To configure, i have created a new profile and have added sso config values in a new profile.properties in resource folder.I am trying to run OSMT api with that security profile and can see in console that application is running with the new security profile.
But,when i open up local OSMT 8080 port in browser,the application keeps redirecting to "http://localhost:8080/oauth2/authorization/okta" and thus,due to that route not being present keeps giving me

"Whitelabel Error Page
This application has no explicit mapping for /error, so you are seeing this as a fallback."

Am i supposed to make some other changes in addition to the ones i specified to spin up OSMT with our internal SSO.
Also,I am seeing the below mentioned dependency in osmt-api module's pom.xml file.Does this dependency needs to be replaced with some dependency for my use-case?

            <groupId>com.okta.spring</groupId>
            <artifactId>okta-spring-boot-starter</artifactId>
            <version>${okta.version}</version>

Looking forward for some help,
Thanks,
Shitiz

[JohnKallies]

Your error presents via the Angular client. You probably need to modify the environment.ts files in ui/src/environments, based on how you are running your Angular build.

You also asked about the Okta Maven dependency in the API module. Your mileage may vary there. Spring's security may be enough for how you run your SSO, or you may need to augment this with customizations. While others may have done this for their own purposes, no one has yet shared a cookbook for how to use another SSO. WGU runs an internal instance of OSMT using our Ping SSO with a slightly different set of Maven dependenciesfor Spring Security, and no Okta.

• My suggestion would be to make a hello world Spring API app, get a Spring/Maven deps config working, at least for the API layer, and emulate those dependencies/settings in your deployment.

[shitizz24]

Upon hitting api with Postman and passing internal sso token as bearer token, i am seeing this error.
Bearer error="invalid_token", error_description="An error occurred while attempting to decode the Jwt: Signed JWT rejected: Another algorithm expected, or no matching key(s) found"

Also, when running on browser, the ui keeps redirecting to the okta login url even when the login Url is changed to SSO authorization url in environment.ts files. Can this be due to the added cacheing functionalities in OSMT?

[JohnKallies]

No, it's probably related to how you are building your Angular files. After changing the URL in your relevant environment*.ts file, what steps are you taking to build them?

[shitizz24]

After making the change in environment.ts file,I am running the spring appliction with this command
mvn -q -Dspring-boot.run.profiles=dev,apiserver,"${security_profile}" spring-boot:run
Here, security profile is the one where i have added internal SSO config values,much similar to application.oauth2-okta.properties file in resources folder

[shitizz24]

@JohnKallies
would it be possible to share or sum up what all changes were essentially made by WGU to set up OSMT with internal SSO?

Thanks!

[JohnKallies]

Trying my question from above again, how are you rebuilding your Angular files after making the changes in environment.ts? This will be pretty important to changing the environment config in an Angular application.

Re: changes for WGU's internal SSO... I didn't do that work and wasn't around when someone figured it out. Here in a public discussion, I can observe that the okta-spring-boot-starter dependency is absent, and spring-security-oauth2-resource-server and spring-security-oauth2-jose are present.