Skip to content

Single sign-on with Okta

Use OIDC. SAML is the alternative if your organisation standardises on SAML apps (Alternative: SAML).

Verify your email domain first (Single sign-on).

Create the OIDC app

  1. In the Okta Admin Console, go to Applications > Create App Integration > OIDC - OpenID Connect > Web Application.
  2. Keep the Authorization Code grant type. Leave Sign-in redirect URIs empty for now and clear the default sign-out redirect URI.
  3. Under Assignments, choose who may sign in, then save.
  4. Copy the Client ID and a Client secret from the General tab.
  5. Optional, for group mapping: on the Sign On tab, edit OpenID Connect ID Token and set Groups claim type to Filter, name groups, with a filter that matches the groups you want to map.

Finish in Preloop

  1. Go to Account settings > Single sign-on and click Add OIDC connection.
  2. Issuer: your Okta org URL, for example https://example.okta.com. If you use a custom authorization server, enter its issuer instead (for example https://example.okta.com/oauth2/default); the groups claim from step 5 above is set on the org server, so add it to the custom server's claims if you use one.
  3. Enter the client id and secret. Scopes: openid email profile. Choose the default role and whether first sign-in creates a membership. Enable the connection and save.
  4. Copy the connection's callback URL into the Okta app's Sign-in redirect URIs and save the app.
  5. If you added the groups claim, set Groups claim or attribute to groups and add the mappings you need.
  6. Click Test sign-in and sign in through Okta.
  7. Optional: turn on Require single sign-on (Enforcement and break-glass).

Alternative: SAML

Create the SAML app

  1. In Preloop, go to Account settings > Single sign-on, click Add SAML connection, enter a name and save. Copy the SP metadata URL and the ACS URL.
  2. In the Okta Admin Console, go to Applications > Create App Integration > SAML 2.0.
  3. Under Configure SAML:
  4. Single sign-on URL: the Preloop ACS URL. Leave "Use this for Recipient URL and Destination URL" checked.
  5. Audience URI (SP Entity ID): the Preloop SP metadata URL.
  6. Name ID format: Persistent (or EmailAddress if every user's email is permanent).
  7. Application username: Email.
  8. Attribute Statements: email = user.email, and optionally displayName = user.displayName.
  9. Group Attribute Statements (optional): name groups, with a filter that matches the groups you want to map.
  10. Under Show Advanced Settings, keep the response and assertion signed with RSA-SHA256. If you set an SP signing key in Preloop, upload the public SP certificate shown on the connection as the signature certificate.
  11. Finish, then assign the app to the users or groups who should sign in.
  12. Copy the app's Metadata URL from the Sign On tab.

Finish the SAML connection in Preloop

  1. Edit the connection. Under Import identity provider metadata, paste the Okta metadata URL, click Preview metadata, then Apply metadata to editor.
  2. If you added a group statement, set Groups claim or attribute to groups and add the mappings you need.
  3. Choose the default role and whether first sign-in creates a membership. Enable the connection and save.
  4. Click Test sign-in and sign in through Okta.
  5. Optional: turn on Require single sign-on (Enforcement and break-glass).