> ## Documentation Index
> Fetch the complete documentation index at: https://docs.dqlabs.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Okta

> Step-by-step guide to configuring Okta as the SAML 2.0 identity provider for single sign-on into Prizm.

<script type="application/ld+json">
  {`{
            "@context": "https://schema.org",
            "@type": "TechArticle",
            "headline": "Okta SSO",
            "description": "Step-by-step guide to configuring Okta as the SAML 2.0 identity provider for single sign-on into Prizm.",
            "url": "https://docs.dqlabs.ai/security/sso/okta",
            "publisher": {
              "@type": "Organization",
              "name": "DQLabs Inc",
              "logo": "https://media.brand.dev/332adc35-5bc4-4d2b-bf78-256aa4a5e414.svg"
            }
            }`}
</script>

## Overview

This guide describes how to configure **Okta** as the SAML 2.0 Identity Provider (IdP) for PRIZM. After completing the configuration, users assigned to the PRIZM application in Okta can securely access PRIZM using their corporate credentials.

## Prerequisites

Before you begin, ensure you have:

* Okta Administrator privileges
* Permission to create SAML applications
* PRIZM Administrator access
* PRIZM Service Provider (SP) details:
  * Entity ID
  * ACS URL
  * Sign-on URL

## Step 1: Configure Okta

1. Navigate to **Applications → Create App Integration**.
   <Frame>
     <img src="https://mintcdn.com/dqlabs/TEcT5Ut9iQfMyPTP/images/image-41.png?fit=max&auto=format&n=TEcT5Ut9iQfMyPTP&q=85&s=13268c809edb1745a58d0a603130fc46" alt="Image" width="1343" height="310" data-path="images/image-41.png" />
   </Frame>
2. Select **SAML 2.0** and click **Next**.
   <Frame>
     <img src="https://mintcdn.com/dqlabs/vhus-wmK0F9HWSLx/images/image-42.png?fit=max&auto=format&n=vhus-wmK0F9HWSLx&q=85&s=e3deeb9975c90ff61aeba1552db806ee" alt="Image" width="933" height="535" data-path="images/image-42.png" />
   </Frame>
3. Enter the application name (for example, **PRIZM**).
4. Configure the following SAML settings using the values available in **PRIZM → Profile → Organization → SSO/SAML**:
   <Frame>
     <img src="https://mintcdn.com/dqlabs/vhus-wmK0F9HWSLx/images/image-43.png?fit=max&auto=format&n=vhus-wmK0F9HWSLx&q=85&s=e2e480289122be8ad979a108990ae4ea" alt="Image" width="732" height="545" data-path="images/image-43.png" />
   </Frame>

| Okta Field                  | PRIZM Value |
| :-------------------------- | :---------- |
| Single Sign-On URL          | ACS URL     |
| Audience URI (SP Entity ID) | Entity ID   |
| Default Relay State         | Sign-on URL |

5. Configure the required attribute mappings:

| PRIZM Attribute     | Okta Attribute                  |
| :------------------ | :------------------------------ |
| emailaddress        | [user.email](http://user.email) |
| givenname           | user.firstName                  |
| surname             | user.lastName                   |
| groups *(optional)* | User Groups                     |

<Frame>
  <img src="https://mintcdn.com/dqlabs/Et-m4pdhigovaLjm/images/image-45.png?fit=max&auto=format&n=Et-m4pdhigovaLjm&q=85&s=e934cfee91ef532d9e88dad1184f6aa2" alt="Image" width="1415" height="602" data-path="images/image-45.png" />
</Frame>

<Frame>
  <img src="https://mintcdn.com/dqlabs/TEcT5Ut9iQfMyPTP/images/image-46.png?fit=max&auto=format&n=TEcT5Ut9iQfMyPTP&q=85&s=29b1b63d4b3d1d88897ceba70c3c59d8" alt="Image" width="679" height="676" data-path="images/image-46.png" />
</Frame>

6. Complete the application setup.

> <Frame>
>   <img src="https://mintcdn.com/dqlabs/XQsoZNdlCRuYucXP/images/image-48.png?fit=max&auto=format&n=XQsoZNdlCRuYucXP&q=85&s=fd077302612b7e33c227ed1d6ebef4e6" alt="Image" width="2906" height="2092" data-path="images/image-48.png" />
> </Frame>

## Step 2: Configure PRIZM

1. In Okta, open the PRIZM application.
2. Navigate to the **Sign On** tab.
3. Download the **Identity Provider Metadata XML** (open the XML file URL and save the it in XML format)
4. In PRIZM, navigate to: **Profile → Organization → SSO/SAML**
5. Enable **Single Sign-On**.
6. Select **Okta** as the Identity Provider.
7. Upload the Metadata XML.
8. Click **Update Configuration**.

> <Frame>
>   <img src="https://mintcdn.com/dqlabs/XQsoZNdlCRuYucXP/images/image-50.png?fit=max&auto=format&n=XQsoZNdlCRuYucXP&q=85&s=62174cb0851d84f471f8efb7aa699a2d" alt="Image" width="1065" height="401" data-path="images/image-50.png" />
> </Frame>

## Step 3: Assign Users

In Okta:

* Open the PRIZM application.
* Navigate to **Assignments**.
* Assign the required users or groups.
  <Frame>
    <img src="https://mintcdn.com/dqlabs/XQsoZNdlCRuYucXP/images/image-51.png?fit=max&auto=format&n=XQsoZNdlCRuYucXP&q=85&s=a6df3400b0a86b877082fd86c1b7dd3d" alt="Image" width="808" height="193" data-path="images/image-51.png" />
  </Frame>

In PRIZM:

Go to the access page and enable SSO for the users.

Users must be assigned before testing SSO.

## Step 4: Test Login

1. Navigate to the PRIZM login page.
2. Enter your corporate email address.
3. Authenticate through Okta.

After successful authentication:

* Existing PRIZM users are signed in.
* New users are automatically created during their first login (JIT provisioning).
* Roles are assigned based on incoming group mappings.

### SCIM Provisioning (Optional)

1. Navigate to **Applications → PRIZM → Provisioning**.
2. Click **Configure API Integration**.
3. Enable **API Integration**.
4. Enter:
   * **SCIM Base URL**
   * **Bearer Token**
5. Click **Test API Credentials**.
6. Enable provisioning.
7. Assign users or groups.