---
description: >-
  Step-by-step guide on setting up the RudderStack SSO (Single Sign-On) feature
  with Okta.
---

# Okta SSO Setup

This guide lists the steps to configure and enable Okta SSO for your organization.

RudderStack does not support IdP-initiated authentication. To use Okta SSO for your organization, you will have to log in through https://app.rudderstack.com/sso.

[![Github Badge](https://img.shields.io/static/v1?label=Plan\&message=Enterprise\&color=blueviolet)](https://rudderstack.com/enterprise-quote)

## Configuring the RudderStack SSO App

1. Log into your Okta application as an **administrator**. Then, go to the **Applications** page in the dashboard.
2. Click on the **Create App Integration** button to integrate Okta with RudderStack, as shown:

![Create App Integration](https://876606571-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Lq5Ea6fHVg3dSxMCgyQ%2Fuploads%2Fgit-blob-280d1947b5641e307bafb8fd2fa7473687465cb8%2Fokta-sso-1.png?alt=media)

1. Select **SAML 2.0** sign-in method, as shown:

![SAML 2.0](https://876606571-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Lq5Ea6fHVg3dSxMCgyQ%2Fuploads%2Fgit-blob-dd1f1ec30f567f34ae12586c857fce0569520c56%2Fokta-sso-2.png?alt=media)

1. Under **General Settings**, set the **App name** to **RudderStack**, as shown. Then, click on **Next**.

![Rudderstack as app name](https://876606571-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Lq5Ea6fHVg3dSxMCgyQ%2Fuploads%2Fgit-blob-ad7dc4e0c662f9bf9a53f4c263f91d5351fc40b2%2Fokta-sso-3.png?alt=media)

### SAML settings

Enter the following settings in the **Configure SAML** section:

![Enter the settings](https://876606571-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Lq5Ea6fHVg3dSxMCgyQ%2Fuploads%2Fgit-blob-7c959e260f5681dd8e9a2502ea517b3be1d8b0b3%2Fokta-sso-4.png?alt=media)

* **Single sign on URL**: Set this to `https://auth2.rudderstack.com/saml2/idpresponse`.

Make sure you also enable the **Use this for Recipient URL and Destination URL** option under this setting.

* **Audience URI (SP Entity ID)**: Set this to `urn:amazon:cognito:sp:us-east-1_ABZiTjXia`.
* **Default RelayState**: Leave this field blank.
* **Name ID format**: Select **Unspecified** from the dropdown.
* **Application username**: Select **Okta username** from the dropdown.
* **Update application username on**: Select **Create and update** from the dropdown.

### Attribute Statements settings

In the **Attribute Statements** section, you need to enter the following settings:

![](https://876606571-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Lq5Ea6fHVg3dSxMCgyQ%2Fuploads%2Fgit-blob-efc49280af0c3b4a9782771b4f81265de61daab2%2Fokta-sso-5.png?alt=media)

| Name     | Name format (optional) | Default value   | Comments                                                                       |
| -------- | ---------------------- | --------------- | ------------------------------------------------------------------------------ |
| Email    | Unspecified            | `user.email`    | Set the value corresponding to **your organization's** user email.             |
| LastName | Unspecified            | `user.lastName` | Although `user.lastName` is recommended, you can provide any other value here. |

As long as the attributes you set match the **Email** and **LastName** fields, your SSO should work without any issues.

In the next page, select the **I'm an Okta customer adding an internal app** option and click on **Finish**.

The RudderStack Single Sign-On app is now created and you will be directed to the app's page.

## Enabling SSO

The RudderStack SSO app supports dynamic configuration.

In the **Sign On** section of the app, copy the **Identity Provider metadata** URL present under the **View Setup Instructions** button, as shown:

![Identity provider metadata](https://876606571-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Lq5Ea6fHVg3dSxMCgyQ%2Fuploads%2Fgit-blob-f6e5c302ecdbf242e503d5739a374c9a8608acfe%2Fokta-sso-6.png?alt=media)

Share this URL with the RudderStack team to enable SSO for your organization.

## Contact us

For queries on any of the sections covered in this guide, you can [contact us](mailto:%20docs@rudderstack.com) or start a conversation in our [Slack](https://rudderstack.com/join-rudderstack-slack-community) community.
