SAML2 → OAuth Token Exchange Failing: Assertion Invalid (SAML App + OIDC App in Same Okta Org)

Questions SAML
1

Hello Team,

I am trying to implement an Okta-to-Okta token exchange using the SAML2 assertion grant.
My setup is fully within the same Okta org, and I am using:

  • A SAML 2.0 Application for user authentication

  • An OIDC (OAuth) Application to issue tokens

  • The OIDC app has urn:ietf:params:oauth:grant-type:saml2-bearer enabled

Flow:

  1. User logs in through the SAML 2.0 application (Okta is the IdP).

  2. I receive the SAMLResponse at my ACS endpoint.

  3. I extract the raw SAML Assertion and encoded into base 64 format.

  4. I POST it to the Okta /token endpoint with the SAML2 assertion grant.

  5. Okta returns an assertion error such as “assertion’ is not a valid SAML 2.0 Assertion”.

Problem:
Despite everything appearing correct, Okta still rejects the assertion.