Guides

Set up SAML with Okta

Step by step: register a SAML application in Okta, then check the sign-in with ID-Kit.

The steps

1. Admin console → Applications → Create App Integration → SAML 2.0 → Next, give it a name.

2. Single sign-on URL = https://app.example.com/saml/acs ; Audience URI (SP Entity ID) = https://app.example.com/saml/metadata ; Name ID format = EmailAddress ; Application username = Email. Next → Finish.

3. Assignments tab: assign a person or a group.

4. Sign On tab → "Metadata URL" (or Actions → View IdP metadata): copy the address and paste it into ID-Kit.

Check the sign-in

Start a sign-in, get the SAML response, then paste it into theanalyseur : ID-Kit checks the signature, audience, receiving address and clock.

Common errors

• Okta: the user is not assigned to the application (access_denied)
• Okta: the redirect_uri is not in the allowed list
• “Invalid audience” / “Audience restriction”
• “Wrong ACS URL” / “Recipient” / “Destination”