Note: Single sign-on is available only on qualifying plans. If you would like to know whether your plan supports SSO, please contact [email protected].
Setup
Create a SAML app in Okta
Open the Okta Developer Console. For more information, see Okta's Redesigned Admin Console and Dashboard on the Okta website.
In the navigation menu, expand Applications, and then choose Applications.
Choose Create App Integration.
In the Create a new app integration menu, choose SAML 2.0 as the Sign-in method.
Choose Next.
For more information, see Prepare a SAML integration in the Build a Single Sign-On (SSO) Integration guide on the Okta Developer website.
Configure SAML integration for your Okta app
On the Create SAML Integration page, under General Settings, enter a name for your app.
(Optional) Upload a logo and choose the visibility settings for your app.
Choose Next.
Under GENERAL, for Single sign on URL and Audience URI (SP Entity ID), enter
US multi-tenant:
for Single sign on URL:
https://ond.auth.us-east-1.amazoncognito.com/saml2/idpresponseFor Audience URI (SP Entity ID):
urn:amazon:cognito:sp:us-east-1_pUtX6J3XMEU multi-tenant:
for Single sign on URL:
https://ond-prod.auth.eu-west-1.amazoncognito.com/saml2/idpresponseFor Audience URI (SP Entity ID):
urn:amazon:cognito:sp:eu-west-1_990dPQ8mSO&D requires these attributes to be mapped correctly:
emailaddressname
The first user to sign in using SSO will be set as the Super Admin in O&D. Afterwards, new users signing in will be assigned the Member role. User roles can be changed by Super Admin and Admin users in O&D from the Settings > Organization > Members page.
Claim name | Value |
<email address> | |
<full name> |
6. For all other settings on the page, leave them as their default values or set them according to your preferences.
7. Choose Next.
8. Choose Finish.
For more information, see Create your integration in the Build a Single Sign-On (SSO) Integration guide on the Okta Developer website.
Assign a user to your Okta application
On the Assignments tab for your Okta app, for Assign, choose Assign to People.
Choose Assign next to the user that you want to assign.Note: If this is a new account, the only option available is to choose yourself (the admin) as the user.
(Optional) For User Name, enter a username, or leave it as the user's email address, if you want.
Choose Save and Go Back. Your user is assigned.
Choose Done.
For more information, see Assign users in the Build a Single Sign-On (SSO) Integration guide on the Okta Developer website.
Get the IdP metadata for your Okta application
On the Sign On tab for your Okta app, find the Identity Provider metadata and share it.
For more information, see Specify your integration settings in the Build a Single Sign-On (SSO) Integration guide on the Okta Developer website.
⚠️Common error
Logging in directly from the Okta dashboard isn’t working is because we use AWS Cognito, which does not support IdP-initiated login flows. That’s why SSO via the login link (SP-initiated flow) still works as expected. You can find more details here: Okta Support Article.
However, Okta does provide a workaround that simulates the IdP-initiated login flow. This involves creating a Bookmark Application in Okta, which can be added to the dashboard to give users a similar experience.