Create SAML app integrations

SAML app integrations use federated authentication standards to give end users one-click access to your SAML application. The App Integration Wizard (AIW) generates the XML needed for the SAML request.

Before you begin

If your app integration contains links to instructions, prevent access issues by adding Okta to your list of sites that can always use cookies. See Allow third-party cookies.

Task 1: Launch the Wizard

  1. In the Admin Console, go to Applications > Applications.
  2. Click Create App Integration.
  3. Select SAML 2.0 as the Sign-on method.
  4. Click Next.

Task 2: Configure general settings

  • App name: Specify a name for your integration using UTF-8 3-byte characters.
  • App logo: Optional. Add a logo to accompany your integration in the Okta org. The logo file must be PNG, JPG, or GIF format and be smaller than 1 MB in size. For best results, use a PNG image with a transparent background and a landscape orientation. Use a minimum resolution of 420 x 120 pixels to prevent upscaling.
  • App visibility: Choose whether to hide your integration from your end users' homepage.

Task 3: Configure SAML settings

A SAML 2.0 configuration requires a combination of information from both your org and the target app. For help with completing each field, use your app-specific documentation and the Okta tool tips.

  • Single sign-on URL: The location to send the SAML assertion using a POST operation. This URL is required and serves as the default Assertion Consumer Services (ACS) URL value for the Service Provider (SP). This URL is always used for Identity Provider (IdP) initiated sign-on requests.
    • Use this for Recipient URL and Destination URL: Select this checkbox if you want the recipient and destination URL to be the same.
      • Recipient URL: (Appears if the previous checkbox isn't selected.) The location where the application can present the SAML assertion. This is usually the Single Sign-On (SSO) URL.
      • Destination URL: (Appears if the previous checkbox isn't selected.) The location to send the SAML Response, as defined in the SAML assertion. This should be the same location as the Single sign on URL unless your application explicitly defines a specific value.
  • Audience URI (SP Entity ID): The intended audience of the SAML assertion. This is usually the Entity ID of your application.
  • Default RelayState: The page where users land after a successful sign-in using SAML into the SP. This should be a valid URL. Consult the SP documentation to get this information.
  • Name ID format: The username format that you're sending in the SAML Response. Consult the SP documentation to determine which format to use, but use the default (Unspecified) if the application doesn't explicitly specify a format.
  • Application username: The default value to use for the username with the application.
  • To maintain security, don't use fields that end users can edit.

  • Attribute Statements (optional): When you create a SAML integration, or modify an existing one, you can define custom attribute statements. These statements are inserted into the SAML assertions shared with your app.
  • Group Attribute Statements (optional): If your Okta org uses groups to categorize users, you can add group attribute statements to the SAML assertion shared with your app.
  • The Dynamic SAML feature doesn't change the way attribute statements are entered or processed by the Okta Expression Language. This feature enables SAML attribute statements to be processed by apps in the Okta Integration Network. Previously the attribute statements were only available for apps created using the App Integration Wizard.

  • Click < > Preview the SAML Assertion to view the XML generated from the Configure SAML section of the SAML App Wizard.

Task 4: Configure feedback

If you're an Okta customer adding an integration that is intended for internal use only:

  • Select I'm an Okta customer adding an internal app
  • Select This is an internal app that we have created. However, if your app requires more SAML configuration instructions to work with Okta, select It's required to contact the vendor to enable SAML. Fill in the provided fields to help the Okta support team understand your SAML configuration.
  • Click Finish. Your integration is created in your Okta org.
  • The Settings page for your integration appears, where you can modify any of the parameters and assign your integration to users.

If you’re an independent software vendor who wants to add your integration to the Okta Integration Network (OIN):

  • Select I'm a software vendor. I'd like to integrate my app with Okta.
  • Click Finish. Your integration is created in your Okta org.
  • The Settings page for your integration appears, where you can modify any of the parameters and assign your integration to users.
  • After you’re satisfied that all settings are correct and you've completed your preliminary testing, click Submit your app for review. This opens the OIN manager site and begins the OIN submission process.

When you add an app integration from the OIN, Okta generates an Update application event that appears in the System Log. This event reflects the creation of a new instance of an existing app.

When you create an app using the App Integration Wizard (AIW), Okta generates a Create application event that appears in the System Log. This event reflects the creation of a new app.

Task 5: Manage Signing Certificates

After you create the SAML app integration, the SAML Signing Certificates section appears on the Sign On tab. You must configure your app integration to verify signed SAML assertions for SSO and trust Okta as the Identity Provider.

You might see two certificates available. If so, notice that one is active and one is inactive. The active certificate is scoped only for your app integration, while the inactive one is scoped for your entire org. Okta recommends keeping the app-only certificate active. Optionally, you can generate and activate a new certificate.

Perform the following steps to obtain the necessary settings to provide for your SAML app:

  1. Set the Status for the certificate that you want to be Active.

    If it isn’t active, select Activate in the Actions menu for another certificate, or click Generate new certificate and activate the new certificate.

  2. Your SSO configuration isn't complete until you perform the following steps.

  3. Under SAML Setup, click View SAML setup instructions.

  4. Depending on your application, either:

    • Copy the IdP settings and download the certificate
    • Copy all the IdP metadata if your application can consume it

Next steps

If your integration doesn't behave as expected, contact Okta Support.