Setting Up Okta Orgs as SAML IdP and SAML SP for Dynamic ACS URL Support

Setting up Security Assertion Markup Language (SAML) app integrations between two Okta orgs enables single sign-on (SSO) functionality. Configure the external Identity Provider (IdP) in the Service Provider (SP) org, set up the SP application in the IdP org, and configure the certificates to establish the integration.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Security Assertion Markup Language (SAML) app integrations between two Okta orgs
• Service Provider (SP)
• Identity Provider (IdP)

How is the external IdP set up in the SP org?

Configure the external Identity Provider in the Service Provider org by navigating to the Security menu and adding a new SAML 2.0 IdP.

1. Go to Security > Identity Providers > Add Identity Provider > Add SAML 2.0 IdP.

2. Enter a name for the IdP and set IdP Username to idpuser.subjectNameid.

3. Select Create New User (JIT) to create the IdP user profile in the SP org after successful authentication.

4. Use an IdP Signature Certificate example (for example, <okta-certificate-example.crt>) to ensure successful creation of the external IdP.

5. Save the settings and retrieve the Assertion Consumer Service URL and Audience URI for use in the next step.

How is the SP application configured in the IdP org?

Create a new SAML 2.0 application in the Identity Provider org and configure the Single Sign-On URL and Audience URI using the values retrieved from the Service Provider org.

1. Go to Applications > Add Application > Create New App > SAML 2.0 > Create.
2. Enter the app name and click Next.

3. Enter the Assertion Consumer Service URL from the SP org external IdP into the Single Sign-On URL field, and select the Use this for Recipient URL and Destination URL checkbox.

4. Enter the Audience URI from the SP org external IdP into the Audience URI field in the app, and leave the remaining settings as default.

5. Scroll down to ATTRIBUTE STATEMENTS (OPTIONAL) and configure the required attributes to pass in the SAML response.

6. If using the Dynamic ACS URL feature, which uses a signed SAML Request, select Validate SAML requests with signature certificates.

7. Keep the default settings, click Finish, and assign the app to a user.

8. Under Sign On, in the bottom right corner, select View SAML Setup Instructions. Single sign-on using SAML requires configuring an app to trust Okta as an IdP.

9. Retrieve the Identity Provider Single Sign-On URL and Identity Provider Issuer values from the SAML instructions to update the IdP in the SP org.

How is the external IdP setup completed in the SP org?

Complete the external Identity Provider setup in the Service Provider org by updating the SAML protocol settings with the values retrieved from the Identity Provider org.

1. Go to Security > Identity Providers and select the Configure Identity Provider option for the IdP created earlier.

2. Copy the Identity Provider Single Sign-On URL and Identity Provider Issuer values, and paste them into the IdP Single Sign-On URL and IdP Issuer URI fields in the SAML Protocol Settings.

Configure the Certificates for the Integration

Download the certificates from both the Identity Provider and Service Provider orgs, convert them to PEM format, and upload them to the respective SAML configuration settings.

1. Download the certificate from the IdP org and convert the .crt file to a .pem file using the following command:

   openssl x509 -in example.cert -out example.pem -outform PEM.

2. Upload the .pem file to the SP org under SAML Protocol Settings.

3. Download the certificate from the SP org and convert the .crt file to a .pem file using the following command:

   openssl x509 -in example.cert -out example.pem -outform PEM

4. Upload the .pem file to the IdP org by navigating to SAML Config > Settings and selecting the Show Advanced link.