> ## Documentation Index > Fetch the complete documentation index at: https://docs.iru.com/llms.txt > Use this file to discover all available pages before exploring further. # Single Sign-On with Okta (SAML) > Configure SAML-based SSO between Okta and Iru Endpoint. Create the SAML application in Okta and map user attributes for admin authentication. ### About Okta SAML Integration Single Sign-On with Okta (SAML) in Iru Endpoint lets you set up SAML-based SSO integration with Okta for users accessing Iru Endpoint through their Okta credentials. #### How It Works Okta SAML integration lets users authenticate to Iru Endpoint using their existing Okta credentials. Once configured, users can access Iru Endpoint through a single sign-on experience. The integration works by establishing a trusted relationship between Iru Endpoint and Okta, where Okta acts as the identity provider (IdP) and Iru Endpoint acts as the service provider (SP). When users attempt to access Iru Endpoint, they're redirected to Okta for authentication, and upon successful login, Okta sends a SAML assertion back to Iru Endpoint confirming the user's identity. SSO can be used for [Iru Endpoint Web App](/en/endpoint/getting-started/foundation/admins-and-access) sign-in and for [Require Authentication with Automated Device Enrollment](/en/endpoint/enrollment/configure-require-authentication-for-enrollment). ### Setting Up the SAML Connection You'll need to complete the initial setup in Iru Endpoint first to get the configuration information required for Okta. After copying the Entity ID and ACS URL, switch to the [**Okta Configuration**](#okta-configuration) tab and continue with [**Configuring Okta Application**](#configuring-okta-application). In Iru Endpoint, in the sidebar, click the [**Account Menu Button**](/en/iru/platform-overview/account-menu). Click the **Access** option in the menu. Screenshot of the account menu with Access option highlighted Select the **Admin and authentication** tab (selected by default) and scroll down to **Authentication methods**. Click **+ Authentication method**. Enter a display name for the SSO Connection. Select **SAML** for the Authentication method. Click **Create**. Click **Configuration information** if that section is not already expanded. Copy the **Service provider entity ID** into a text document for later use. You'll need this for the Okta configuration. Copy the **Assertion consumer service (ACS) URL** into a text document for later use. You'll need this for the Okta configuration. Configuration Information, Service provider entity ID, and Assertion consumer service (ACS) URL Keep the Iru Endpoint configuration modal open, then switch to the [**Okta Configuration**](#okta-configuration) tab to continue with [**Configuring Okta Application**](#configuring-okta-application). ### Configuring Iru Endpoint SAML Connection After completing the Okta configuration, return here to finish [**Configuring Iru Endpoint SAML Connection**](#configuring-iru-endpoint-saml-connection) in Iru Endpoint. You'll need the Single Sign-on URL, IdP Entity ID, and certificate from Okta. Go back to the Custom SAML modal in Iru Endpoint. Set **IdP attribute** to **Subject**. Leave **Attribute name** blank. Set **User attribute** to **User Principal Name (UPN)**. Paste the Single Sign-On URL you copied from Okta into the **Sign In URL** text field. Paste the **Issuer** information you copied from Okta into the **IdP Entity ID** field. Upload the Okta certificate you downloaded earlier. Iru Endpoint upload Okta certificate Set the **Protocol Binding** to **HTTP-POST**. Ensure that the **Request Algorithm** is set to **RSA-SHA256**. Ensure that **Sign Request Algorithm Digest** is set to **SHA256**. Ensure that **Sign Request** is enabled. Set the **Response Signature Verification** to **Assertion**. Leave the **Destination** field blank. Set **Allowed Signature Algorithm** to **RSA-SHA256**. Set **Allowed Digest Algorithm** to **SHA256**. Click **Save**. Iru Endpoint Save for SAML configuration ### Allow for Tenant Authentication Once you have configured the SAML connection in Iru Endpoint and your identity provider, you can allow its use for tenant authentication. For step-by-step instructions, please refer to the **Allowing Tenant Authentication and Managing Connections** section in our [Single Sign-on support article](/en/endpoint/integrations/single-sign-on-integrations/single-sign-on). ### Limit Authentication to Domain When configuring the SAML connection, you can optionally limit authentication to one or more domains. This can be useful when the SSO connection could authenticate to multiple domains. You can limit the authentication to your Iru tenant to a subset of the available domains. ### Enforcing Single Sign-On Once you have configured at least one Single Sign-on connection, you can disable Passkey, Google Social, and Microsoft Social connections. Disabling these connections will disable the ability for Iru Endpoint administrators in your tenant to authenticate via those methods. Please refer to our [Single Sign-on support article](/en/endpoint/integrations/single-sign-on-integrations/single-sign-on) for step-by-step instructions. ### Testing the Integration Add a test user to the **Admin Team** in Iru Endpoint by clicking **New User**. Fill in all of the corresponding user information. This user must exist in Okta and must be assigned to the Okta SSO app in your Okta tenant. Click **Submit**. Once the invite is submitted, close the Invite User window. Refresh the Access page in Iru Endpoint. You should see the user who was added. Go to the user's email to accept the invite and log in with the new SAML SSO connection. Before starting the Okta configuration, complete [**Setting Up the SAML Connection**](#setting-up-the-saml-connection) in the [**Iru Web App Configuration**](#iru-web-app-configuration) tab to get the Service Provider Entity ID and ACS URL. You'll need these values to configure the Okta application. ### Configuring Okta Application In a new browser tab, log in to the **Admin Console** in your Okta tenant. On the left-hand side, click the reveal triangle next to **Applications**, then click **Applications**. Click **Create App Integration**. Okta Admin Console Create App Integration Select **SAML 2.0** as the app integration type. Click **Next**. Okta Select SAML 2.0 and Next Enter an **App name**. Upload an optional **App logo**. Click **Next**. Okta App name and App logo and Next In the **Single sign-on URL** field, paste the Iru Endpoint Assertion Consumer Service URL that was copied earlier. In the **Audience URI (SP Entity ID)** field, paste the Iru Endpoint Entity ID that was copied earlier. Ensure that the **Name ID format** is set to **Unspecified**. Ensure that the **Application username format** is set to **Email**. Ensure that **Update application username on** is set to **Create and update**. Select **Next**. Okta SAML Single sign-on URL Audience URI and Next Select **This is an internal app that we have created**. Click **Finish**. Okta This is an internal app and Finish Back at the **Sign On** tab, find the link to **View SAML setup instructions** and open it in a new browser tab. Okta Sign On tab View SAML setup instructions Copy the **Identity Provider Single Sign-On URL** and save it in a text document for later use in Iru Endpoint. Copy the **Identity Provider Issuer** information and save it in a text document. You will paste this into the **IdP Entity ID** field in Iru Endpoint. Download the certificate file and save it for use in Iru Endpoint. Okta SAML setup instructions and download certificate ### Assigning Users to the Okta App Go back to the Okta app and click the **Assignments** tab. Click the **Assign** dropdown menu and click **Assign to People** or **Assign to Groups**. Okta app Assignments tab with Assign dropdown for Assign to People or Assign to Groups Search for users or groups to assign. Click **Assign** next to the user or group. Okta Assign next to user or group Click **Save and Go Back**. Okta Save and Go Back after assigning user Once the user is assigned, click **Done**. Okta Done to complete user assignment You should see the users or groups that you have selected in the list. Okta Assignments list showing assigned users or groups After completing the Okta Configuration, return to the **Iru Web App Configuration** tab to finish setting up the SAML connection using the SSO URL, Entity ID, and certificate you copied from Okta.