# Inbound Federation using okta-auth-js SDK **URL:** \ **Category:** SAML\ **Tags:** oauth, reactjs, saml\ **Created:** [April 11, 2022, 12:46pm UTC](https://devforum.okta.com/t/inbound-federation-using-okta-auth-js-sdk/20193 "2022-04-11T12:46:17Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![ShaikLuqmaan](https://avatars.discourse-cdn.com/v4/letter/s/e19adc/32.png) [@ShaikLuqmaan](https://devforum.okta.com/u/ShaikLuqmaan)\ **Post date:** [April 11, 2022, 12:46pm UTC](https://devforum.okta.com/t/inbound-federation-using-okta-auth-js-sdk/20193/1 "2022-04-11T12:46:17Z")
We have a SPA that uses okta-auth js SDK to authenticate users. Now we wanted to implement a use case where the external IDP users will be able to access our application using Okta’s Inbound Federation. To implement the same do we have **idpDiscovery** and **features** object properties present in okta auth js SDK, which are needed while configuring the application? I was able to implement the same flow with the Okta sample app which was using the **okta-sign-in widget** SDK and those properties were part of it and were require to complete the flow. ---
**Author:** ![andrea](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/andrea/32/2172_2.png) [@andrea](https://devforum.okta.com/u/andrea)\ **Post date:** [April 11, 2022, 3:58pm UTC](https://devforum.okta.com/t/inbound-federation-using-okta-auth-js-sdk/20193/2 "2022-04-11T15:58:27Z")
To complete the federated login, the Sign In Widget calls the [webfinger endpoint](https://developer.okta.com/docs/reference/api/webfinger/), sending the username to determine which Identity Provider the user is associated with. When using Auth JS, you can make this same API call using [webfinger(options)](https://github.com/okta/okta-auth-js#webfingeroptions). In the response to this call, you will get the IdP ID back, which you can then [include it as a parameter in your /authorize request as part of the options](https://github.com/okta/okta-auth-js#authorize-options). That will result in the user getting redirected directly to their IdP and then back to your OIDC application (with the auth code/tokens) via the redirect\_uri once they’re logged in. ---
**Author:** ![ShaikLuqmaan](https://avatars.discourse-cdn.com/v4/letter/s/e19adc/32.png) [@ShaikLuqmaan](https://devforum.okta.com/u/ShaikLuqmaan)\ **Post date:** [April 28, 2022, 12:11pm UTC](https://devforum.okta.com/t/inbound-federation-using-okta-auth-js-sdk/20193/3 "2022-04-28T12:11:01Z")
When trying to hit the Webfinger endpoint, using the following cURL ```auto curl --location --request GET 'https://dev-94069277.okta.com/.well-known/webfinger?resource=okta:acct:finaltest%40z-mail.io' \ --header 'Accept: application/jrd+json' \ --header 'Content-Type: application/json' \' ``` This is the response that we get ![image](https://global.discourse-cdn.com/oktadev/original/2X/4/4f2a6930704d8b2097817e255f7c06a315df3bdb.png) Did not find the idpID in the response. And also getting the same response when using some non-existing user as well. FYI: The user passed in the request (finaltest@z-mail) was created by JIT during the federated login. The external SAML IDP is configured in this domain ([http://dev-94069277.okta.com](http://dev-94069277.okta.com)) and the routing rule is also defined for the user’s domain ([z-mail.io](http://z-mail.io)) ---
**Author:** ![andrea](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/andrea/32/2172_2.png) [@andrea](https://devforum.okta.com/u/andrea)\ **Post date:** [April 28, 2022, 3:18pm UTC](https://devforum.okta.com/t/inbound-federation-using-okta-auth-js-sdk/20193/4 "2022-04-28T15:18:38Z")
Can you try without encoding the `@` symbol? What if you remove the domain and just make the request with `finaltest`? ---
**Author:** ![ShaikLuqmaan](https://avatars.discourse-cdn.com/v4/letter/s/e19adc/32.png) [@ShaikLuqmaan](https://devforum.okta.com/u/ShaikLuqmaan)\ **Post date:** [April 28, 2022, 8:21pm UTC](https://devforum.okta.com/t/inbound-federation-using-okta-auth-js-sdk/20193/5 "2022-04-28T20:21:53Z")
![image](https://global.discourse-cdn.com/oktadev/original/2X/9/9118b620a0e88377713c55652629047b231106b0.png) Same response even without the domain ---
**Author:** ![brh55](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/brh55/32/3008_2.png) [@brh55](https://devforum.okta.com/u/brh55)\ **Post date:** [April 29, 2022, 1:17am UTC](https://devforum.okta.com/t/inbound-federation-using-okta-auth-js-sdk/20193/6 "2022-04-29T01:17:52Z")
It looks like in this instance, the “finaltest” account matching IdP is actually the Okta instance itself. I suspect that this user is hitting the default rule. In that case, I would check to make sure your routing rule’s condition is configured to match the “finaltest” user to their corresponding federated IdP. ---
**Author:** ![ShaikLuqmaan](https://avatars.discourse-cdn.com/v4/letter/s/e19adc/32.png) [@ShaikLuqmaan](https://devforum.okta.com/u/ShaikLuqmaan)\ **Post date:** [May 1, 2022, 5:20pm UTC](https://devforum.okta.com/t/inbound-federation-using-okta-auth-js-sdk/20193/7 "2022-05-01T17:20:00Z")
I have two okta instances where one instance ( dev-94 ) can be considered as OUR IDP and acts as the IDP for the sample application to which we want the external users to give access and the other okta instance (dev-15 ) acts as the external IDP from which the users will be redirected from the SAML app configured in it back to the sample app through IDP initiated federated login and that user will be created in the OUR IDP through JIT. The above flows work fine when used with a sample app using Okta-Sign-In Widget. But not able to implement the same flow with other sample application which uses Okta Auth SDK. FYI: IDP configuration and routing rules (with domain rule ) are configured correctly in the dev-94 instance and when tried to hit the Webfinger API with a user that is created through JIT not able to get the IDP ID. Does the external IDP has to be some IDP other than Okta inorder to use webfinger? or passing **rel** parameter as part of request helps ? ---
**Author:** ![andrea](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/andrea/32/2172_2.png) [@andrea](https://devforum.okta.com/u/andrea)\ **Post date:** [February 12, 2024, 7:20pm UTC](https://devforum.okta.com/t/inbound-federation-using-okta-auth-js-sdk/20193/8 "2024-02-12T19:20:39Z")