Cloud · Single sign-on · 03
Set up single sign-on with Okta
Connect Okta to Zym Labs over SAML, test it and turn it on.
This guide connects Okta Workforce Identity to your organization, so your team signs in to Zym Labs with their Okta account. You'll add Zym Labs as a SAML app in Okta, give Cloud its metadata URL, test a sign-in and turn the connection on. It takes about 20 minutes.
You need to be an organization owner or admin in Cloud; an owner turns the connection on. In Okta you need to be able to create app integrations.
Before you start
- A verified domain in your organization. See Verify a domain.
- Your own account at your identity provider on that domain, to test with.
- How single sign-on works, if you haven't read it: it explains what turning the connection on changes for your team.
Steps
Start the connection in Cloud
In your organization, open Single sign-on and choose Set up SSO (or New connection). Choose Okta, and under Domain this connection signs in, choose your domain. Keep this page open.
Create the app in Okta
In the Okta admin console, open Applications, choose Create App Integration and choose SAML 2.0. Name it Zym Labs and continue.
Paste Zym Labs' values
Under SAML Settings, paste the values Cloud shows: the Identifier (Entity ID), https://idp.zymlabs.cloud/realms/zymlabs-cloud, and the Reply URL, which is unique to your connection. Add the attribute statements email, firstName and lastName, mapped to user.email, user.firstName and user.lastName.
Then assign the people or groups who should sign in, under the app's Assignments tab.
Give Cloud the metadata URL
On the app's Sign On tab in Okta, copy the Metadata URL. In Cloud, choose I've done this, paste it into Metadata URL and continue. With a URL, Cloud picks up Okta's new signing certificate whenever it rotates.
Check the attributes
Cloud fills in the attribute names for Email, First name and Last name. Change them only if your directory sends something different, then continue.
Test a sign-in
Choose Start test sign-in and sign in with your own work account in the window Cloud opens. When it works, Cloud shows Passed and what your provider sent for each attribute. To test with someone else's account, see Test a connection.
Turn it on
An owner chooses Activate connection. If you're an admin, choose Save as draft, and an owner can activate it later from Single sign-on. Passwords keep working until you require single sign-on.
What's next
- Require single sign-on: send everyone on your domain to Okta.
- Troubleshoot single sign-on: when a test or a sign-in fails.