> ## Documentation Index
> Fetch the complete documentation index at: https://docs.operata.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Configure Okta as an SSO identity provider

> Set up a SAML 2.0 application in Okta so Operata users sign in through your corporate directory.

Configure a SAML 2.0 application in your Okta tenant so Operata users authenticate through your corporate directory instead of an Operata password.

## Before you start

* An Okta tenant where you can administer applications.
* An [Operata SSO request open with Operata Support](/docs/guides-request-sso) and the connection name Operata supplied in the reply.
* The email domains your users sign in with.

<Note>
  Operata supports Service-Provider-initiated login only. IdP-initiated login is not supported.
</Note>

<Warning>
  Do not use underscores in connection names, application names, or any other identifier you create here. Auth0 rejects underscores in SAML connection metadata.
</Warning>

## Steps

### 1. Note the URLs Operata supplied

Operata Support replies to the SSO request with the connection name and the two URLs you set on the Okta side. Connection names follow the form `idp-type-customer-name` — for example `okta-acme`.

**Development and test**

* Single Sign-On URL: `https://login-dev.operata.io/login/callback?connection=<connection-name>`
* Audience Restriction: `urn:auth0:dev-operata:<connection-name>`

**Production**

* Single Sign-On URL: `https://login.operata.io/login/callback?connection=<connection-name>`
* Audience Restriction: `urn:auth0:prod-operata:<connection-name>`

### 2. Create a SAML 2.0 application in Okta

Sign in to your Okta admin console and create a new application. Choose **SAML 2.0** as the application type. Include "Operata" in the application name so it surfaces in audits and support handoffs.

### 3. Configure the SAML application

Set the two values from step 1 on the Okta application:

* Paste the **Single Sign-On URL** into Okta's Single Sign-On URL field.
* Paste the **Audience Restriction** into Okta's Audience URI (SP Entity ID) field.

Save the application. Okta generates an App Embed Link and an X.509 signing certificate.

### 4. Capture the app metadata

From the configured application, copy:

* The **App Embed Link** — for example `https://acme.okta.com/home/.../<unique_connection-name>/`.
* The **X.509 signing certificate** Okta generated, downloaded in PEM or CER format.

### 5. Send the metadata to Operata

Reply to the open Operata Support thread with:

* The App Embed Link.
* The X.509 signing certificate.
* The email domains to route to this SSO connection.

<Note>
  All listed domains route to the same SSO connection. Operata cannot split domains across separate Okta applications on a single Operata account.
</Note>

### 6. Add test users and run a joint test

Add a test user to your Okta application under **Directory → People**. Operata configures Auth0, confirms it is ready, and schedules a joint test call. On the call you sign in from `https://app.operata.io` with the test user's email; Auth0 redirects to Okta, Okta authenticates, and you land in the Operata console.

## Result

A user whose email matches one of the domains you listed visits `https://app.operata.io`, enters their email, and is redirected to Okta. After Okta authenticates, the user lands in the Operata console without entering an Operata password.

## Related

* [Request SSO for your Operata account](/docs/guides-request-sso) — the generic SSO request workflow this guide plugs into.