authenticate to SharePoint through OKTA from back-end service
<p>I have a need to programmatically connect to a customer's SharePoint server that uses OKTA for authentication.  I saw this <a href="https://stackoverflow.com/questions/35233948">post</a> which looked promising, but cannot seem to get a valid session cookie back from OKTA.</p>

<p>I can successfully call the /api/v1/authn endpoint and get back a sessionToken, but when I turn around and call /api/v1/sessions?additionalFields=cookieToken with that session token, I always received a 403 - Forbidden, with the following json:</p>

<pre><code>{ 
"errorCode": "E0000005", 
"errorSummary": "Invalid Session", 
"errorLink": "E0000005", 
"errorId": "oaew0udr2ElRfCnZvBFt075SA", 
"errorCauses": [] 
}
</code></pre>

<p>Assuming I can get this resolved, I'm not sure of the URL I should call with the cookieToken.  Is the url an OKTA endpoint that will redirect to SharePoint or is it an SharePoint endpoint that will setup the session with the cookie?</p>

<p><strong>Update:</strong>
I am able to call this okta endpoint -> /api/v1/sessions?additionalFields=cookieToken with my user credentials as json</p>

<pre><code>{ 
"username": "user@email.com",
"password": "P@ssw0rd"
}
</code></pre>

<p>And am able to retrieve a one-time cookie token that can be used with this link to start a SAML session in a browser:</p>

<pre><code>https://[mydomain].okta.com/login/sessionCookieRedirect?redirectUrl=[sharepoint site url]&amp;token=[cookie token]
</code></pre>

<p>That works in a browser, the user is automatically authenticated and ends up in SharePoint.  However, it seems that this session "setup" is at least partly achieved through javascript as executing the same link in a programmatic HTTP client (such as Apache HTTP Client) does not work.  The http client is sent through a couple of redirects and ends up in the SharePoint site, but the user is not authenticated.  The response is 403 - Forbidden with the following headers:</p>

<p>403 - FORBIDDEN</p>

<pre><code>Content-Type -&gt; text/plain; charset=utf-8
Server -&gt; Microsoft-IIS/8.5
X-SharePointHealthScore -&gt; 0
SPRequestGuid -&gt; 0ecd7b9d-c346-9081-cac4-43e41f3b159a
request-id -&gt; 0ecd7b9d-c346-9081-cac4-43e41f3b159a
X-Forms_Based_Auth_Required -&gt; https://[sharepoint site]/_login/autosignin.aspx?ReturnUrl=/_layouts/15/error.aspx
X-Forms_Based_Auth_Return_Url -&gt; https://[sharepoint site]/_layouts/15/error.aspx
X-MSDAVEXT_Error -&gt; 917656; Access denied. Before opening files in this location, you must first browse to the web site and select the option to login automatically.
X-Powered-By -&gt; ASP.NET
MicrosoftSharePointTeamServices -&gt; 15.0.0.4709
X-Content-Type-Options -&gt; nosniff
X-MS-InvokeApp -&gt; 1; RequireReadOnly
Date -&gt; Fri, 13 May 2016 15:02:38 GMT
Content-Length -&gt; 13
</code></pre>

<p>I'm starting to wonder if this is a lost cause, that OKTA or SharePoint doesn't support programmatic authentication via SAML.</p>