Oxelone Docs

Search docs and API

Find a guide, a section of one, or an API operation by its name.

Open console (opens in a new tab)

Administration Okta

Single sign-on with Okta

This page connects Okta to Oxelone over SAML 2.0. It uses the values on Single sign-on, so read that page first for who can do this and what each setting means. You need the Owner role in Oxelone and permission to create apps in Okta.

Set it up

  1. In Oxelone, open Settings › Access › Single sign-on and set Protocol to SAML 2.0. Leave the page open. It shows the ACS URL and the Entity ID.

  2. In the Okta Admin Console, go to Applications and Resources › Applications and create a new app. Choose the Classic experience, then SAML 2.0 as the sign-in method, and name the app.

  3. In the SAML settings, map the console's values to Okta's fields:

    OxeloneOkta
    ACS URLSingle sign-on URL
    Entity IDAudience URI (SP Entity ID)

  4. Set the name ID that Okta sends to the person's email address. Oxelone identifies people by email address.

  5. Finish creating the app. Assign the app to the people or groups who should sign in.

  6. On the app's Sign On tab, in the SAML 2.0 section, find Identity Provider metadata. Copy its address, or open it and copy the XML.

  7. Back in Oxelone, paste it into IdP metadata.

  8. Add your Email domains, choose Test connection, switch on Sign in with SSO and choose Save.

Sign in once from Oxelone's sign-in page, with Continue with SSO, before you turn on Require SSO. Starting from Okta's app tile does not work; Oxelone refuses a response it did not ask for.

When it goes wrong

  • The IdP metadata isn't valid SAML metadata. The text pasted is not Okta's metadata. Copy it again from Identity Provider metadata.
  • The IdP's signing certificate has expired. Okta's certificate has lapsed. Rotate it in Okta, then paste the metadata again.
  • Your identity provider's answer couldn't be verified. Try again, or ask your administrator. (on the sign-in page) The Single sign-on URL or Audience URI (SP Entity ID) in Okta does not match the console's ACS URL or Entity ID exactly, or the response is not signed.
  • You're not a member of this workspace yet. Ask an owner to invite you. (on the sign-in page) The person is assigned in Okta but Create members on first sign-in is off in Oxelone.

The other messages are listed on Single sign-on.

With the API

Not available with an API key.

Okta's own documentation