AEM 6.5 (Apache Sling) /saml_login not running postProcessor

Question

I have a protected page setup in AEM using the Authentication Requirement checkbox on the author. Then over in the OSGi I have config for my external Okta SAML config:

<?xml version="1.0" encoding="UTF-8"?>
<jcr:root xmlns:sling="http://sling.apache.org/jcr/sling/1.0"
          xmlns:jcr="http://www.jcp.org/jcr/1.0"
          jcr:primaryType="sling:OsgiConfig"
          identitySyncType="default"
          keyStorePassword="admin"
          service.ranking="5002"
          idpHttpRedirect="{Boolean}false"
          createUser="{Boolean}true"
          defaultRedirectUrl="/"
          userIDAttribute="ssoGuid"
          idpIdentifier=""
          assertionConsumerServiceURL=""
          defaultGroups="[everyone]"
          storeSAMLResponse="{Boolean}false"
          signatureMethod="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"
          idpCertAlias="certalias___1657659258516"
          addGroupMemberships="{Boolean}true"
          path="[/content/mySite]"
          digestMethod="http://www.w3.org/2001/04/xmlenc#sha256"
          synchronizeAttributes="[...]"
          clockTolerance="60"
          groupMembershipAttribute="groupMembership"
          idpUrl="oktaURL"
          serviceProviderEntityId="https://stage.mySite.com"
          logoutUrl=""
          handleLogout="{Boolean}false"
          userIntermediatePath="sso"
          spPrivateKeyAlias=""
          useEncryption="{Boolean}false"
          nameIdFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"/>

And in my okta config, I have https://stage.mySite.com/saml_login as the SSO URL and https://stage.mySite.com as the audience restriction.

When I navigate to the requested page in AEM I get redirected to Okta, I sign in and am redirected to https://stage.mySite.com/saml_login , all of this is expected, here is where it gets weird, I then get a 301 redirect to https://stage.mySite.com/saml_login.html which then gives a 404. It seems like AEM does not have a listener setup and so does the redirect.

Any thoughts on what i might have misconfigured?

Answer 1

In my case, it was a dispatcher config issue (or nginx, not sure where the rewrite was done). It was setup to append '.html' if it does not exist in the requested url. I needed to make an exception for that rule.