Skip to main content

SAML Single Sign-on 🔐 with Okta as the Identity Provider

How to setup SAML SSO with Okta as the Identity Provider (IdP)?

Written by Mohamed Berrada

Before proceeding with this article, ensure that you have read our article about SAML Single Sign-on 🔐

Here, we will outline the steps to set up Okta as an Identity Provider.

1️⃣ Create an Okta SAML Web application

  1. Log in to the Okta Developer Console

  2. Sign in with an administrator account

  3. From the left sidebar, expand Applications, then click on Applications

  4. Click on Create App Integration

  5. Choose SAML 2.0 as the Sign-in method

  6. Click on next

  7. Enter an App name for your application (e.g. "Fabriq") and click on Next

2️⃣ Configure the application for SAML SSO

  1. On the Configure SAML page, you will need to fill in the:

    • Single sign-on URL

    • Audience URI (SP Entity ID)

  2. Click on Save

3️⃣ Configure the attributes for SAML SSO

  1. Set Name ID format to Persistent.

  2. Set Application username to user.getInternalProperty("id"), or another unique and immutable value.

New Okta configuration

Navigate to:

Applications → Applications → Fabriq → Sign On → Attribute Statements

Click Add expression, then add the following attributes one by one:

Name

Expression

http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress

user.profile.email

http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname

user.profile.firstName

http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname

user.profile.lastName

The attribute statements should look like this:

Legacy Okta configuration

If you do not see the Add expression interface, expand Show legacy configuration.

Under Attribute Statements, add the same attributes one by one and set the Name format to Unspecified:

Name

Value

http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress

user.email

http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname

user.firstName

http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname

user.lastName

Then click Next, followed by Finish.

4️⃣ Assign users to Fabriq

  1. Navigate to the Assignments tab

  2. You can either give access to the Fabriq SAML app to:

    1. everyone in your organization

    2. specific groups/users

5️⃣ Get the App Federation Metadata file

  1. Navigate back to the Sign On tab

  2. Scroll down to SAML Signing Certificates

  3. Click on the Actions button next to your preferred certificate, then click on View IdP metadata

  4. Copy the URL

Did this answer your question?