> For the complete documentation index, see [llms.txt](https://docs.flosum.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.flosum.com/global-settings/security/identity-providers-sso/saml-identity-providers/okta-saml-configuration.md).

# Okta - SAML - Configuration

{% hint style="success" %}

#### Required User Credentials

\[**Flosum User**] - **SystemAdministrator** Role
{% endhint %}

{% hint style="success" %}

#### Important Note

The instructions in this article cover a third-party app and may not reflect the latest version. Please use these instructions as a guide to complete the task, but be aware that some screens, field names, and steps may have changed.
{% endhint %}

## ![](https://579543750-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FsEk2hU5IMh3HEY5dJZjR%2Fuploads%2FSxcnKlaJKPzDqONWoDNv%2FSummary2-Small-Icon.svg?alt=media\&token=5e3253d0-a069-4ba5-9c06-83c70bd0b21d) Overview

This article explains how to integrate an Okta identity provider with Flosum Cloud Apps using SAML authentication to enable Single Sign-On (SSO), allowing users to access the platform seamlessly with their existing credentials.

{% hint style="info" %}
For more general instructions about adding an Identity Provider, see the following article.

* [Adding an Identity Provider (SSO)](/global-settings/security/identity-providers-sso/adding-an-identity-provider-sso.md)
  {% endhint %}

{% hint style="warning" %}

#### Customer-Hosted

Customers who host Flosum Apps on their own infrastructure will have a custom URL for logging into their apps. When using this documentation, replace any **Flosum Hosted URLs** with your own URLs.
{% endhint %}

## Configure Okta

{% stepper %}
{% step %}

### Create Application

1. Log in to the **Okta Admin Console**. 
2. Navigate to **Applications**. 
3. Click **Create App Integration**. 
4. Select **SAML 2.0** as the **Sign-in method**. 
5. Click **Next**. 
6. Enter an **App name**. 
7. Click **Next**.
   {% endstep %}

{% step %}

### Configure SAML Settings

1. Click the **Single sign-on URL** textbox and enter the SAML URL for your region from the table below.

<table><thead><tr><th width="159.6666259765625">Region</th><th>SAML URL</th></tr></thead><tbody><tr><td>United States</td><td>https://global-us.flosum.app/api/v1/saml/acs</td></tr><tr><td>Germany</td><td>https://global-de.flosum.app/api/v1/saml/acs</td></tr><tr><td>Japan</td><td>https://global-jp.flosum.app/api/v1/saml/acs</td></tr><tr><td>Australia</td><td>https://global-au.flosum.app/api/v1/saml/acs</td></tr></tbody></table>

2. Click **Audience URI (SP Entity ID)** and enter a unique identity for this SSO. This can be any unique string value.
3. Click **Add identifier** and enter a unique identity for this SSO. This can be any unique string value.
4. Click **Show Advanced Settings**.
5. Click **Response** and select **Signed**.
6. Click **Assertion Signature** and select **Signed**.
7. (Optional) The **Assertion Encryption (optional)** setting isn't required to work with Flosum SSO. Configure only if required by your security or compliance policies.
   1. If required, you will need a public certificate and private key pair.
   2. Upload the public certificate to the **Encryption Certificate**.
8. (Optional) The **Signed Requests (optional)** setting isn't required to work with Flosum SSO. Configure only if your security or compliance policies require signed authentication requests (AuthnRequest).
   1. If required, you will need a public certificate and private key pair.
   2. Enable **Signed Requests**
   3. Upload the public certificate to the **Signature Certificate**.
9. Click **Next**.
10. Click **Finish**.
    {% endstep %}

{% step %}

### Configure Attribute Statements

1. Open the **Sign On** tab.&#x20;
2. Scroll down to **Attribute Statements**.&#x20;
3. Click **Show legacy configuration**.&#x20;
4. Click **Edit** under **Profile attribute statements**.
5. Add the following attribute statements.

| Name         | Source attribute |
| ------------ | ---------------- |
| firstName    | user.firstName   |
| lastName     | user.lastName    |
| email        | user.email       |
| uniqueUserId | device.trusted   |

{% hint style="info" %}
The **uniqueUserId** claim can be mapped to any user attribute that is both unique and constant.
{% endhint %}
{% endstep %}

{% step %}

### Assign Users

1. Open the **Assignments** tab.
2. Click **Assign → Assign to People**.
3. Assign the application to the required users.
4. Click **Save and Go Back**.
5. Click **Done**.
   {% endstep %}

{% step %}

### Create Identity Provider in Global Settings

Follow the general instructions in the article below to get started creating a SAML Identity Provider.

1. [Adding an Identity Provider (SSO)](/global-settings/security/identity-providers-sso/adding-an-identity-provider-sso.md)
2. Complete the **Basic information** section.
   1. Select **SAML** for the identity provider **Type**.
3. Complete the **Button information** section.
4. (Optional) Complete the **Group information** section.

#### **Complete SAML 2.0 Information Fields**

Copy the information from your Okta application into the SAML 2.0 Information section. The first two screenshots below show which Okta application fields to copy. The table explains where to enter this information. The final screenshot shows a completed identity provider for an Okta SAML application.

<div align="left"><figure><img src="https://579543750-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FsEk2hU5IMh3HEY5dJZjR%2Fuploads%2F9GxXgWCRo0ZCgcU7uKqd%2FOktaSamlConfig-Okta-01.png?alt=media&amp;token=a6c0e2e1-047f-4cf9-b663-a1e4afb51cd3" alt="" width="563"><figcaption></figcaption></figure></div>

<div align="left"><figure><img src="https://579543750-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FsEk2hU5IMh3HEY5dJZjR%2Fuploads%2FELZWHAJf1l0tDaADS6sj%2FOktaSamlConfig-Okta-02.png?alt=media&amp;token=43cf9ddb-b056-448a-9acd-a234dca25584" alt="" width="563"><figcaption></figcaption></figure></div>

<table><thead><tr><th width="179.6666259765625">Flosum Field</th><th>Okta Field</th><th>Instructions</th></tr></thead><tbody><tr><td><strong>Issuer</strong></td><td>General Tab → SAML Settings → <strong>Audience Restriction</strong></td><td></td></tr><tr><td><strong>Entity ID</strong></td><td>Sign On Tab → Settings → More details → <strong>Issuer</strong></td><td>Click the <strong>Copy</strong> icon to copy this link.</td></tr><tr><td><strong>Identity Provider Sign Certificate</strong></td><td>Sign On Tab → Settings → More details → <strong>Signing Certificate</strong></td><td>Click <strong>Download</strong> to download the certificate. Once downloaded, click <strong>Identity Provider Sign Certificate</strong> and upload it.</td></tr><tr><td><strong>Name ID format</strong></td><td></td><td>Leave blank</td></tr><tr><td><strong>Identity Provider Login URL</strong></td><td>Sign On Tab → Settings → More details → <strong>Sign on URL</strong></td><td>Click the <strong>Copy</strong> icon to copy this link.</td></tr></tbody></table>

<div align="left"><figure><img src="https://579543750-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FsEk2hU5IMh3HEY5dJZjR%2Fuploads%2F70j8MmQy1nmUQrIzizqC%2FOktaSamlConfig-Flosum-01.png?alt=media&amp;token=cfbd640b-b7d8-406e-9a1f-eb451da41790" alt="" width="563"><figcaption></figcaption></figure></div>

#### SAML Signed Request Enabled

If General Tab → SAML Settings → **SAML Signed Request** is **Enabled:**

1. Check the **SAML Signed Request Enabled** checkbox.
2. Complete the fields in the table below.

<table><thead><tr><th width="180.33331298828125">Flosum Field</th><th>Value</th></tr></thead><tbody><tr><td><strong>Auth Sign Certificate</strong></td><td>Click to upload the public certificate that corresponds to the verification certificate.</td></tr><tr><td><strong>Auth Private Key</strong></td><td>Click to upload the private key that matches the public certificate.</td></tr><tr><td><strong>Auth Private Key Password</strong></td><td>Enter the passphrase for the private key if encrypted.</td></tr><tr><td><strong>Auth Sign Algorithm</strong></td><td>Leave blank (or specify if required).</td></tr></tbody></table>

#### Assertion Encryption Enabled

If General Tab → SAML Settings → **Assertion Encryption** is **Encrypted**:

1. Check the **Assertion Encryption Enabled** checkbox.
2. Complete the fields in the table below.

<table><thead><tr><th width="180.33331298828125">Field</th><th>Description</th></tr></thead><tbody><tr><td><strong>Encryption Certificate</strong></td><td>Click to upload the public certificate that is used for assertion encryption.</td></tr><tr><td><strong>Encryption Private Key</strong></td><td>Click to upload the private key that pairs with the public certificate.</td></tr><tr><td><strong>Encryption Private Key Password</strong></td><td>Enter the passphrase for the private key if encrypted.</td></tr></tbody></table>
{% endstep %}

{% step %}

### Save and Test

{% hint style="info" %}
For instructions on logging in with SSO, see the following article.

* [Logging In With SSO](/global-settings/security/identity-providers-sso/logging-in-with-sso.md)
  {% endhint %}

1. Click **Save** to save the identity provider.
2. To test, open an incognito window.
3. Start logging in to Global Settings with your tenant name.
4. If the identity provider was configured successfully, you should see the SSO button you created.&#x20;

<div align="left"><figure><img src="https://579543750-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FsEk2hU5IMh3HEY5dJZjR%2Fuploads%2FutMuZrPQFHKOwmRPgx7i%2FOktaSamlConfig-Login-01.png?alt=media&amp;token=7d3d3afb-0671-4036-8b11-c9973efb0d83" alt="" width="375"><figcaption></figcaption></figure></div>
{% endstep %}
{% endstepper %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.flosum.com/global-settings/security/identity-providers-sso/saml-identity-providers/okta-saml-configuration.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.