Couple of things to watch out for anyone having similar issues:
- Have basic auth first with challenge flag set to false, so that it continues to the next authentication domain.
- Ensure the entity_id matches the “Audience Restriction” exactly - it’s case sensitive.
- If your SSO URL ends with _opendistro/_security/saml/acs/idpinitiated access through okta. If it’s set up as _opendistro/_security/saml/acs - access via kibana URL.