Skip to main content
Configure a SAML 2.0 application in your Okta tenant so Operata users authenticate through your corporate directory instead of an Operata password.

​
Before you start

Operata supports Service-Provider-initiated login only. IdP-initiated login is not supported.
Do not use underscores in connection names, application names, or any other identifier you create here. Auth0 rejects underscores in SAML connection metadata.

​
Steps

​
1. Note the URLs Operata supplied

Operata Support replies to the SSO request with the connection name and the two URLs you set on the Okta side. Connection names follow the form idp-type-customer-name — for example okta-acme. Development and test
  • Single Sign-On URL: https://login-dev.operata.io/login/callback?connection=<connection-name>
  • Audience Restriction: urn:auth0:dev-operata:<connection-name>
Production
  • Single Sign-On URL: https://login.operata.io/login/callback?connection=<connection-name>
  • Audience Restriction: urn:auth0:prod-operata:<connection-name>

​
2. Create a SAML 2.0 application in Okta

Sign in to your Okta admin console and create a new application. Choose SAML 2.0 as the application type. Include “Operata” in the application name so it surfaces in audits and support handoffs.

​
3. Configure the SAML application

Set the two values from step 1 on the Okta application:
  • Paste the Single Sign-On URL into Okta’s Single Sign-On URL field.
  • Paste the Audience Restriction into Okta’s Audience URI (SP Entity ID) field.
Save the application. Okta generates an App Embed Link and an X.509 signing certificate.

​
4. Capture the app metadata

From the configured application, copy:
  • The App Embed Link — for example https://acme.okta.com/home/.../<unique_connection-name>/.
  • The X.509 signing certificate Okta generated, downloaded in PEM or CER format.

​
5. Send the metadata to Operata

Reply to the open Operata Support thread with:
  • The App Embed Link.
  • The X.509 signing certificate.
  • The email domains to route to this SSO connection.
All listed domains route to the same SSO connection. Operata cannot split domains across separate Okta applications on a single Operata account.

​
6. Add test users and run a joint test

Add a test user to your Okta application under Directory → People. Operata configures Auth0, confirms it is ready, and schedules a joint test call. On the call you sign in from https://app.operata.io with the test user’s email; Auth0 redirects to Okta, Okta authenticates, and you land in the Operata console.

​
Result

A user whose email matches one of the domains you listed visits https://app.operata.io, enters their email, and is redirected to Okta. After Okta authenticates, the user lands in the Operata console without entering an Operata password.