Application Integration Wizard SAML field reference
General Settings
| App logo | Upload a logo to use for your integration in the Okta org. The logo must be in PNG, JPG, or GIF format, and be smaller than 1 MB. For best results, use a PNG image with a transparent background and a landscape orientation. Use a minimum resolution of 420 x 120 pixels to prevent upscaling. |
| App visibility | Select Do not display application icon to users to hide your integration from end users. Select Do not display application icon in the Okta Mobile app to hide your integration in the Okta Mobile Apps Store on your end user's devices. |
SAML Settings
| General | |
|---|---|
| Single sign-on URL |
The location to send the SAML assertion using a POST operation. This URL is required and serves as the default Assertion Consumer Services (ACS) URL value for the Service Provider (SP).
This URL is always used for Identity Provider (IdP) initiated sign-on requests.
Use this for Recipient URL and Destination URL is selected by default. This setting uses the same URL for both the recipient and destination URLs. If your integration requires different URLs, clear the checkbox and provide values for the following fields:
|
| Audience URI (SP Entity ID) | The intended audience of the SAML assertion. This is usually the Entity ID of your application. |
| Default RelayState | The URL of the resource to direct users after they successfully sign in to the SP using SAML. See the SP documentation to check if you need to specify a RelayState. In most instances, you can leave this field blank. |
| Name ID format | The username format to send in the SAML Response. Use the default (Unspecified) if the application documentation doesn't explicitly specify a format. When NameIdPolicy is included in the SAML Request, the Name ID format must match it. |
| Application username | The default value to use for a user's application username. To maintain security, don't define the application username using fields that end users can edit. |
| Update application username on | Choose when to update the application username. Create and update is the default used by all Application username types. If Application username is Custom, you can choose to update the application username on Create only. This setting prevents the username from changing, even when the value of a field that defines part of the custom username changes. |
Expand Show Advanced Settings to access the following settings:
| Advanced Settings | |
|---|---|
| Response | Choose whether the IdP digitally signs the SAML authentication response message. |
| Assertion Signature | Choose whether the SAML assertion is digitally signed. |
| Signature Algorithm | The signing algorithm used to digitally sign the SAML assertion and response. |
| Digest Algorithm | The digest algorithm used to digitally sign the SAML assertion and response. |
| Assertion Encryption | Choose whether the SAML assertion is encrypted. |
| Encryption Algorithm | The encryption algorithm used to encrypt the SAML assertion. This field appears when Assertion Encryption is Encrypted. |
| Key Transport Algorithm | The key transport algorithm used to encrypt the SAML assertion. This field appears when Assertion Encryption is Encrypted. |
| Encryption Certificate | The file that contains the public key certificate (in PEM format) used to encrypt the SAML assertion. This field appears when Assertion Encryption is Encrypted. |
| Signature Certificate | The file that contains the public key certificate (in PEM format) used to validate the SAML sign-in request and the Single Logout (SLO) request. |
| Enable Single Logout |
Allows users to sign out of both a configured custom app and Okta with a single click (but not out of other apps that are open). See the Single Logout Profile section in Profiles for the OASIS Security Mark Up Language (SAML) version 2.0. This checkbox appears after you upload a Signature Certificate. If SLO is enabled, the SAML setup instructions for your app should include a field for the Identity Provider Single Logout URL. |
| Single Logout URL | Specify where to send the sign-out response. This field appears when Enable Single Logout is selected. |
| SP Issuer | The issuer ID for the service provider. This field appears when Enable Single Logout is selected. |
| Signed Requests | Select this to validate all SAML requests using the Signature Certificate. The payload from the SAML request is validated, and Okta dynamically reads any single sign-on (SSO) URLs from the request. This checkbox appears after you upload a Signature Certificate. When Signed Requests is enabled, the SAML Request must include a NameIDPolicy. |
| Other Requestable SSO URLs | For use with SP-initiated sign-in flows. Enter the ACS URLs for any other requestable SSO nodes used by your app integration. This option enables applications to choose where to send the SAML Response. Specify a URL and an index that uniquely identifies each ACS URL endpoint. Some SAML AuthnRequest messages don't specify an index or URL. In these cases, the SAML Response is sent to the ACS specified in the Single sign on URL field. When you enable Signed Requests, Okta deletes any previously defined static SSO URLs and reads the SSO URLs from the signed SAML request instead. You can't have both static SSO URLs and dynamic SSO URLs. |
| Assertion Inline Hook | An Assertion Inline Hook is an outbound call from Okta to an external service that you created. This type of Inline Hook is triggered when Okta generates a SAML assertion in response to an authentication request. Before sending the SAML assertion to the app that consumes it, Okta calls out to your external service. The external service can respond with commands to add attributes to the assertion or modify its existing attributes. To have Okta call your external service, select the endpoint for the service from the dropdown list. If this option is left set to None (disabled), then no external service is called when an Assertion Inline Hook is triggered. See Inline Hooks, SAML Assertion Inline Hook Reference, and Enabling a SAML Assertion Inline Hook. |
| Authentication context class | The type of authentication restriction for the SAML assertion. Consult the SP documentation to obtain this information. |
| Honor Force Authentication | Set to Yes to prompt users for their credentials when a SAML request has the ForceAuthn attribute set to true. Users are prompted to enter their credentials, even if they normally sign in through Desktop SSO. If this option is set to No, the attribute is ignored. |
| SAML Issuer ID | Use this option when you need to override an Issuer ID. An override is required when more than one sign-in exists for a single application. It can also be used when you have an integration that requires extra attributes. Enter the Issuer ID to override the default value of http://www.okta.com/$(org.externalKey). Obtain the External Key from the setup instructions of the current working application instance. |
| Attribute Statements (optional) | Define custom attribute statements for the integration. These statements are inserted into the SAML assertions shared with your app. See Define attribute statements. |
| Group Attribute Statements (optional) | If your Okta org uses groups to categorize users, you can add group attribute statements to the SAML assertion shared with your app. See Define group attribute statements. |