Use Okta for SSO authentication Learn how to use Okta for Single Sign-On (SSO) authentication with SAML 2.0 so members of your organization can sign in to Kobiton using their Okta credentials. Get Kobiton parameters First, you’ll need to save a copy of your Kobiton SSO attributes so you can easily add them to your IdP later. Select your profile name or picture, then choose Settings. Choose SSO Settings. From Basic configuration, copy the following values and save them to a note: Entity ID (or Audience URL) Reply (or SSO, or ACS) URL From User attributes (or parameters), copy the following values and save them to a note: email firstName lastName phoneNumber memberOf Later you’ll finish configuring your Kobiton SSO settings so keep this browser window open. Create IdP application In Okta, select Admin. Select Applications, then Create App Integration. For Sign-in method, select SAML 2.0 then choose Next. In General Settings, enter a display name and add a logo to customize your sign-in portal, then select Next. Map parameters and download certificate Now that your IdP application is created, you’ll need to create Okta SSO parameters mapped to Kobiton and download your Okta certificate. Go to SAML Settings to get started. Using your Kobiton SSO parameters from earlier, fill out the following fields: Single sign on URL Use this for Recipient URL and Destination URL: ☑ Allow this app to request other SSO URLs: ☐ Audience URI (SP Entity ID) Default RelayState Next, create the following custom parameters: Parameter 1 Name: email Name format: Basic Value: user.email Parameter 2 Name: firstName Name format: Basic Value: user.firstName Parameter 3 Name: lastName Name format: Basic Value: user.lastName Finally select Download Okta Certificate. When you’re done, select Next, then Finish. Get IdP parameters Next you’ll need to save a copy of your Okta parameters you can add to Kobiton later. Select Sign On, then View Setup Instructions. In your SAML application’s configuration, go to the Sign On tab. Click View Setup Instructions and populate Box 3 of your Kobiton portal SSO settings page with this information. Copy the following values and save them to a note: Identity provider issuer Identity issuer URL Identity provider sign-in URL Identity provider sign-out URL Identity provider certificate Add IdP parameters and certificate to Kobiton Now, you’ll need to add your IdP parameters and certificate to your Kobiton organization. In your SSO Settings, scroll down to Set up at Kobiton side. Add your IdP parameters and certificate to the following: Identity provider issuer Identity issuer URL Identity provider sign in URL Identity provider sign out URL Identity provider certificate The Identity provider certificate must be a .pem file. If the certificate downloaded from the IdP has a different file extension (such as .cert), rename it to .pem before uploading. Verify and save configuration Important: Make sure you have created an account with the same email as the currently logged in Kobiton account and assign the new SAML application to that user on the IdP side before continuing. Select Verify to test your SSO configuration. The system will open a new browser tab to the SSO login page. In this new tab, logs in using the account that has the same email as the current Kobiton account. If logged in successfully, go back to the previous browser tab with the SSO Settings opened. Wait for a while for the SSO Settings page to automatically reload (do not force reload the page) and a success message displays like the below: After receiving the success response, select Save to complete your SSO configuration. After verifying and saving the configuration, you can turn on Enforce users to login to Kobiton only through SSO to force the users to log in only via SSO (optional). When SSO login enforcement is turned on: You can add existing users to be exempted from the SSO login enforcement by adding the username into the Choose users who are allowed to login without SSO field. You also gain access to Specify Organization Access Restrictions with the ability to enable Pass role/team assignments to users in the SAML validations. Choose the method that’s best for your organization.