Configure SAML with Okta

This page explains how to integrate Okta as a SAML Identity Provider to authenticate your users on Reemo.

Note

Depending on your deployment mode, SSO can be enabled at the instance level (Private Cloud / On-Prem) or at the organization level (Public Cloud).

Screenshots and labels may vary slightly depending on your interface version.

Configure SSO in Reemo

Case 1: Instance level (Private Cloud / On-Prem)

From verified_user Admin Area > dashboard General > passkey SSO Connectors, configure SSO for the instance.

Access SSO Connectors in the instance Admin Area.

Case 2: Organization level (Public Cloud)

From domain Organization > dashboard General > passkey SSO Connectors, configure SSO for that organization.

Configure SSO in Organization > SSO Connectors.

Create the SAML Connector in Reemo

1. From verified_user Admin Area > domain Organizations, select your organization, then go to dashboard General > passkey SSO Connectors and click New Connector > New SAML Connector.

2. Fill in the basic fields:

• Friendly Name: the name displayed to your users (e.g., Okta).

• Issuer / App URI ID: reemo.

• Entry Point: will be filled in after configuring Okta.

• IdP Logout URL and Logout protocol (optional): see the Configure Logout at the Identity Provider section below.

• Certificate: will be filled in after configuring Okta.

• Attributes Mapping: attribute names Reemo expects in the SAML assertion (email, username, fullname by default).

3. Click Create to generate the connector’s Callback URL. You will need this in Okta (Single sign-on URL).

Copy the Callback URL generated by the SAML connector.

Configure the SAML Application in Okta

1. Log in to your Okta portal.

2. Go to Applications > Create App Integration > SAML 2.0.

Create a SAML 2.0 integration in Okta.

3. Give the application a name (e.g., Reemo) and click Next.

4. Fill in the main SSO settings:

• Single sign-on URL: paste the Callback URL from the Reemo connector.

• Audience URI (SP Entity ID): reemo.

• Application username: Email.

5. Configure the Attribute Statements as follows:

Name	Name format	Value
email	Unspecified	user.email
fullname	Unspecified	user.lastName

Fill in the Callback URL, Audience, and Attribute Statements.

6. Complete the Okta application creation (Next then Finish).

7. From the created application, go to the Sign On tab and download the Metadata (XML) from the provided URL.

Download the SAML metadata (XML) from Okta.

8. Copy the X.509 Certificate and the Entry Point (SSO URL).

Retrieve the X.509 certificate and Entry Point from Okta.

9. Complete the Reemo SAML connector. Enable the connector (check Enabled) and click Update to save.

Enable the connector after pasting the Entry Point and Certificate from Okta.

Declare users

There are two approaches to grant SSO access to users.

Approach A: Explicit provisioning from the organization

From verified_user Admin Area > domain Organizations, select your organization, then go to inventory_2 Inventory > person Users and click New User > Provision SAML User to add users by entering their email.

Select Provision SAML User from the New User menu.

Add users by email through the provisioning popup.

Approach B: Just-In-Time (JIT) Provisioning

From verified_user Admin Area > domain Organizations, select your organization, then go to dashboard General > passkey SSO Connectors, click the connector then enable Just In Time Provisioning: accounts are created automatically on the first successful SSO login.

Enable Just In Time Provisioning to create accounts on first login.

Configure Logout at the Identity Provider

The SAML connector exposes two additional fields to automatically log the user out of their identity provider (IdP) when they log out of Reemo: an IdP Logout URL and a Logout protocol.

• Redirect to the URL above (default): the browser is simply redirected to the configured URL. Works with any provider exposing a logout endpoint that responds to a plain GET request, with no extra configuration on its side.

• SAML single logout (signed LogoutRequest): Reemo signs an actual LogoutRequest built from the session subject, and handles both the LogoutResponse returned by the provider and any LogoutRequest it initiates on its own. This is the only mode that works with a provider whose logout endpoint is the same as its login endpoint (e.g. Microsoft Entra ID, Keycloak): that endpoint expects a signed SAML request, not a plain GET.

Note

Both fields are optional and backward-compatible: the protocol defaults to Redirect to the URL above, so existing connectors keep their current behavior. The login strategy is never affected, and a logout failure on the provider’s side never blocks the user’s logout from Reemo.

SAML single logout requires a service provider key to exist for this connector: without it, the connector automatically falls back to Redirect to the URL above. Reemo generates this key pair per connector — the private key never leaves the server — and the corresponding certificate, to declare on the provider’s side, is displayed in the SSO connector list.

Warning

SAML single logout requires two declarations on the identity provider’s side: a logout callback URL pointing to Reemo (its format depends on the provider — see the corresponding guide) and the connector’s signing certificate, displayed in the SSO connector list. Without both, the provider rejects the LogoutRequest signed by Reemo.

Warning

In SAML single logout mode, set the IdP Logout URL based on your provider:

• Leave it empty if your provider serves logout on its login endpoint (e.g. Microsoft Entra ID, Keycloak). Reemo then reuses the Entry Point already configured.

• Fill it in if your provider exposes a separate logout endpoint (e.g. Okta).

Warning

Logging out on the identity provider’s side closes the browser session for the whole provider, not just Reemo. A user with other tabs open on the same provider (e.g. other Microsoft services) is logged out of those too.

On Okta, the logout endpoint is separate from the login endpoint: in SAML single logout mode, fill in the IdP Logout URL with the logout URL provided by Okta.

Log in via SAML

Once the connector is active and users are declared (or JIT is enabled), your users can log in:

• General access to your portal (Private Cloud / On-Prem):

  https://[portal_url]/
  

• Direct access to the organization (Public Cloud):

  https://[portal_url]/login/[organization_shortname]
  

On the login screen, select the SSO tab, then click Login to be redirected to the identity provider.

Select the SSO tab, then click Login.