Okta dynamically generates unique metadata for each Security Assertion Markup Language (SAML) app integration. This article describes how to obtain the metadata URL and download the SAML signing certificate for a SAML app integration from the Okta Admin Console.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Okta Integration Network (OIN) Catalog SAML App
• Custom SAML Application
• Single Sign-On (SSO)
• Security Assertion Markup Language (SAML)

How are the IdP metadata and SAML signing certificate downloaded for a SAML app integration?

The following video and procedures describe three distinct methods for retrieving SAML configuration data tailored to the service provider's specific requirements.

Download metadata or the SAML signing certificate

This method allows for the direct download of the metadata file or the active signing certificate.

1. Navigate to the Sign On tab of the SAML application.
2. In the SAML Signing Certificates section, select Actions for the active certificate.

3. Select Download certificate to save the file.
4. Select View IdP metadata to open the metadata file in a new tab.
5. Save the metadata page as an XML file from the browser.

NOTE: Right-click and save the metadata page as an XML file to avoid formatting issues that occur when copying and pasting into a text editor.

Obtain IdP details via View SAML setup instructions

This method provides a formatted page containing the Identity Provider Single Sign-On URL, Identity Provider Issuer, and the X.509 Certificate text for manual application configuration.

1. Navigate to the Sign On tab of the SAML application.
2. Locate and select the View SAML setup instructions option on the right side of the page.
3. Copy the Identity Provider Single Sign-On URL, Identity Provider Issuer, and the X.509 Certificate from the displayed page.

NOTE: The metadata can also be copied from the Optional section.

Obtain IdP details via the Sign On tab

Okta also displays the Identity Provider Single Sign-On URL (Sign on URL), the Identity Provider Issuer (Issuer), and the X.509 Certificate (Signing Certificate) on the Sign On tab of the SAML application in the SAML 2.0 section under Metadata details.