Okta SAML Integration Guide

Suggest an edit

Prerequisites

  • Administrator access to the Okta Admin Console
  • A SplitSecure Identity Provider created and approved
  • A separate browser or browser profile with SplitSecure configured (for testing)

Okta Configuration

1 Create a New Identity Provider

  1. Sign in to Okta Admin Console
  2. Go to Security → Identity Providers
  3. Click Add Identity Provider
  4. Select SAML 2.0 IdP and click next
  5. Enter a descriptive name for this IdP (e.g., “Corporate SAML IdP”)

2 Configure General Settings

Authentication Settings

Field Value
IdP Usage SSO only
Claims No
Account matching with Persistent Name ID Yes

Account matching with IdP Username

Field Value
IdP username idpuser.subjectNameId
Filter No
idpuser.subjectNameId Okta Username or Email
Account link policy Yes
Auto-link filters None
If no match is found Create new user (JIT)

SAML Protocol Settings

Field Value Notes
IdP Issuer URI com.splitsecure.saml2.provider.your-idp-name Found in SplitSecure: Secure Accounts → SAML2 Identity Providers → [Your IdP] → Details as “SAML IdP Entity ID”
IdP Single Sign-On URL https://splitsecure.com/saml2/sp/login
IdP Signature Certificate (Upload certificate file) Download from SplitSecure: Secure Accounts → SAML2 Identity Providers → [Your IdP] → Details → Download Certificate
Request Binding HTTP POST
Application context No
Request Signature Yes
Response Signature Verification Assertion
Response Signature Algorithm SHA-256
Okta Assertion Consumer Service URL Trust-specific
Max Clock Skew 2 Minutes
  1. Click Finish

SplitSecure Configuration

1 Download Okta SAML Metadata

  1. In the Okta Admin Console, navigate to Security → Identity Providers
  2. Locate your IdP and click Actions → Configure Identity Provider
  3. In the Summary card, click Download metadata and save the XML file

2 Create the Okta Secure Account

  1. In SplitSecure, navigate to Secure Accounts → Create Account → Okta
  2. Enter a name for your account
  3. Select the Identity Provider that matches the IdP Issuer URI configured in Okta
  4. Upload the metadata file downloaded in Step 1
  5. Click Create Account

Test Authentication

1 Test Authentication (IdP-Initiated)

  1. In SplitSecure, navigate to Secure Accounts
  2. Locate your new account and click Authenticate
  3. Enter your email address and click Request Access
  4. Complete the Okta authentication flow when prompted

Troubleshooting

Issue Possible Cause Solution
Authentication fails immediately Mismatched IdP Issuer URI Verify the Entity ID matches exactly between Okta and SplitSecure
Certificate errors Expired or incorrect certificate Re-download the certificate from SplitSecure and re-upload to Okta
User not found Account matching misconfigured Ensure the IdP username field and match criteria are correctly set
Clock skew errors Time synchronization issues Increase the Max Clock Skew value or sync server clocks

External Resources