Administrators can configure a custom Security Assertion Markup Language (SAML) 2.0 application in Okta using the relevant fields from a Service Provider (SP) application metadata file. While Okta does not support the direct import of SP application metadata, administrators can manually extract the necessary values to complete the configuration.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Custom SAML 2.0
• Authentication
• Secure Assertion Markup Language (SAML)
• Single Sign-On (SSO)

How is a custom SAML application configured using an SP metadata file?

The following video and steps detail how to create a custom SAML 2.0 application within Okta using the Service Provider application metadata.

1. Navigate to Okta Admin Dashboard > Applications > Applications.
2. Select Create App Integration > SAML 2.0.

3. On the General Settings tab, enter the App name value and select Next.

4. Open the Service Provider metadata file (usually a .xml file) to reference the required SAML settings.
   The following code block provides an example of a SAML .xml metadata file.

   <?xml version="1.0" encoding="UTF-8"?>
   <md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
   entityID="http://mymachine.mycompany.com:8830">
      <md:SPSSODescriptor
   AuthnRequestsSigned="true"
   WantAssertionsSigned="true" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
         <md:KeyDescriptor use="signing">
            <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
               <ds:X509Data>
                  <ds:X509Certificate>MIIC0TCCAbkCAQAwXDELMAkGA1UEBhMCSU4xCzAJBCgKCAQEAmEwfAFLjgDO
                      BgNVBAoTCXJicHJpdmF0ZTELMAkGA1UECxMCUUExETAPBgNVBAMTCHJhamt1bWFyMIIBIjANBgkq
                      hkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAmEwfAFLjgDOEZk1AYPhX7dbYMXqkk4rF3uyYZeoMnnXP
                      Ls463GzGvVPnRgjTdIzm+1QOnkTx3BBu7kxlhtze2Sr7rtHLs1FYbzXREs5aVgIPnpkfuKdR9QND
                      aJJ1byxStnF+zI4feSYmHXsVWfHm24+FK0kCk3tSnw2/noXyW5xc2UbrGLYqaezpPSlf5WJ3isKF
                      lQr2k+HKXh4Rid4TUmEaoZXPAcB7QtkBYnIxzzmBoFCWSSsVldPRkaw=</ds:X509Certificate>
               </ds:X509Data>
            </ds:KeyInfo>
         </md:KeyDescriptor>
         <md:NameIDFormat>
   urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</md:NameIDFormat>
         <md:
   AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
   Location="http://mymachine.mycompany.com:8830/router/login/loginSaml" index="0" isDefault="true" />
      </md:SPSSODescriptor>
   </md:EntityDescriptor>

5. Note the values for the AssertionConsumerService (ACS), NameIDFormat, entityID, and relayState (optional) tags from the metadata file.
6. Navigate back to the custom application configuration in Okta and enter the Single Sign-On URL (ACS), Audience URI (SP Entity ID), Default RelayState (optional), and Name ID format using the values noted from the Service Provider metadata file.
   1. Enter the Single Sign-On URL using the value located between the AssertionConsumerService tags. From the example metadata file, the value is http://mymachine.mycompany.com:8830/router/login/loginSaml.
      • (Optional) Clear the Use this for Recipient URL and Destination URL checkbox to configure multiple values if multiple values are found for the AssertionConsumerService Location.

1. 2. Enter the Audience URI (SP Entity ID) using the entityID value in the metadata file. From the example metadata file, the value is http://mymachine.mycompany.com:8830.
   3. Enter the Default RelayState if required.
   4. Select the Name ID format that matches the NameIDFormat tag in the metadata file. The default value for the example Name ID format is "Unspecified". From the example metadata file, the value is urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified. The example value corresponds to the Unspecified default value in Okta. The NameIDFormat tag in the metadata file varies by Service Provider.

7. Select Next.
8. Select either I'm an Okta customer adding an internal app or This is an internal app that we have created, and select Finish.
9. Navigate to the Sign-On tab in the configured custom SAML application and select View SAML setup Instructions on the right side of the page.
10. Provide the Okta application Identity Provider Single Sign-On URL, the Okta application Identity Provider Issuer (EntityID), and the Okta application Identity Provider X.509 certificate to the Service Provider administrator to configure within the Service Provider application.
11. Assign the application to a test user in Okta and test the SAML login flow once the Identity Provider (IdP) metadata is configured on the Service Provider application.

NOTE: These instructions provide a basic overview of creating a SAML application within Okta. The Service Provider might require additional information, such as custom attributes or additional settings, to enable Single Sign-On functionality.

Related References

• Troubleshoot any issues with SAML-tracer
• Beginner's Guide to SAML
• How to Configure a Custom SAML App
• How To Define and Configure a Custom SAML Attribute Statement