Okta SAML

8 min

The following manual configuration creates a SAML SSO configuration for your Enterprise organization.

Prerequisites

Owner role in an Enterprise organization

Okta account with admin access

Supported features

This configuration supports the following:

Service Provider initiated SSO

Single Log Out [optional]

Configuration steps

Before configuring SSO, you need to assign a namespace and create a Service Provider certificate and private key. These important steps provide information you need to enter later.

Create your namespace:

Go to Organization > SSO.

Under Namespace, enter the namespace you want for your organization. For example, acme_corp. Your organization members enter this namespace when they log in via SSO.

Under SSO type, select SAML 2.0.

Download your Service Provider certificate:

Go to Organization > SSO.

Scroll down to find Service Provider Certificates.

Find a certificate. If unsure, check the Valid from and Expires columns.

Under Actions, click

.

Select Download.

Optional: Click Activate if your certificate is not

Your browser downloads your certificate. Locate the .pem file and have it ready to upload later.

Steps on Okta

Click Create app integration and select SAML 2.0.

Name your app and upload your icon.

Click Next.

Configure the following SAML settings:

Single sign-on URL	You can find this URL in the Redirect URL field of the SSO configuration in your Make organization. Be sure to replace {namespace} with your actual namespace. Example: https://www.make.com/sso/saml/examplenamespace
Audience URI (SP Entity ID)	Add /metadata.xml to the URL in the Redirect URL field of the SSO configuration in your Make organization. Example: https://www.make.com/sso/saml/examplenamespace/metadata.xml
Default RelayState	Leave this field blank
Name ID format	Select EmailAddress
Application username	Select Okta username
Update application username on	Select Create and update

Click Show advanced settings and enter the following:

Response	Select Signed
Assertion signature	Select Signed
Signature algorithm	Select RSA-SHA256
Digest algorithm	Select SHA256
Assertion encryption	Note Optional If you want to encrypt assertions, you can select Encrypted and enter the following: Encryption algorithm AES256-CBC Key transport algorithm RSA-OAEP Encryption certificate Upload the .pem file you created earlier. In step 4 of the following procedure on following procedure on , select No for Allow unencrypted assertions. Select Unencrypted
Signature certificate	Upload the .pem file of the Service Provider Certificate you downloaded earlier. This must be an active certificate from the Service Provider Certificate section of your SSO configuration tab.
Enable Single Logout	Leave unchecked
Signed requests	Optional
Other requestable SSO URLs	Optional
Assertion inline hook	Select None (disable)
Authentication context class	Select PasswordProtectedTransport
Honor force authentication	Select Yes
SAML issuer ID	http://www.okta.com/${org.externalKey}

Enter the following attributes and click Next.

Name	Name format	Value
profileFirstName	Unspecified	user.firstName
profileLastName	Unspecified	user.lastName
email	Unspecified	user.email

Select the following options and click Finish.

Are you a customer or partner?	Select I'm an Okta customer adding an internal app
App type	Select This is an internal app that we have created

To locate your IdP login URL and certificate:

Go to Admin > Applications > Applications and select your SAML SSO app. to access the necessary information.

Go to the Sign on tab and click View SAML setup instructions.

Steps on

Go to Organization > SSO.

Enter the following information from Okta into the IdP login URL and Identity provider certificate fields.

Field on Okta	Field on Admin > System settings
Identity provider single sign on URL	IdP login URL
X.509 certificate	Identity provider certificate

Enter the following in the Login IML resolve field:

{"email":"{{get(user.attributes.email, 1)}}","name":"{{get(user.attributes.profileFirstName, 1)}}{{get(user.attributes.profileLastName, 1)}}","id":"{{user.name_id}}"}

Select the following settings:

Allow unencrypted assertions	Yes
Allow unsigned responses	No
Sign requests	Yes

Click Save.

Service Provider initiated SSO

Go to 's login page.

Click Sign in with SSO.

Enter the namespace you chose for your organization.

Troubleshooting

When you save the SSO configuration, you automatically receive an email with a link to bypass SSO login. Use this link to log in and adjust your configuration as needed.