Configure SAML with Okta

This page explains how to integrate Okta as a SAML Identity Provider to authenticate your users on Reemo.

Note

Depending on your deployment mode, SAML can be enabled at the instance level (Private Cloud / On-Prem) or at the organization level (Public Cloud).

Screenshots and labels may vary slightly depending on your interface version.

Configure SAML in Reemo

Case 1: Instance level (Private Cloud / On-Prem)

From verified_user Admin Area > dashboard General > passkey SSO Connectors, configure SAML for the instance.

Access SSO Connectors in the instance Admin Area.

Case 2: Organization level (Public Cloud)

From domain Organization > dashboard General > passkey SSO Connectors, configure SAML for that organization.

Configure SAML in Organization > SSO Connectors.

Create the SAML Connector in Reemo

1. From verified_user Admin Area > domain Organizations, select your organization, then go to dashboard General > passkey SSO Connectors and click New Connector > New SAML Connector.

2. Fill in the basic fields:

• Friendly Name: the name displayed to your users (e.g., Okta).

• Issuer / App URI ID: reemo.

• Attributes Mapping: attribute names Reemo expects in the SAML assertion (email, username, fullname by default).

• The other fields (e.g., Entry Point, Certificate) will be filled in after configuring Okta.

Fill in the basic fields of the SAML connector.

Enter the friendly name and the Issuer (reemo), then save.

3. Click Create to generate the connector’s Callback URL. You will need this in Okta (Single sign-on URL).

Copy the Callback URL generated by the SAML connector.

Configure the SAML Application in Okta

1. Log in to your Okta portal.

2. Go to Applications > Create App Integration > SAML 2.0.

Create a SAML 2.0 integration in Okta.

3. Give the application a name (e.g., Reemo) and click Next.

4. Fill in the main SSO settings:

• Single sign-on URL: paste the Callback URL from the Reemo connector.

• Audience URI (SP Entity ID): reemo.

• Application username: Email.

5. Configure the Attribute Statements as follows:

Name	Name format	Value
email	Unspecified	user.email
fullname	Unspecified	user.lastName

Fill in the Callback URL, Audience, and Attribute Statements.

6. Complete the Okta application creation (Next then Finish).

7. From the created application, go to the Sign On tab and download the Metadata (XML) from the provided URL.

Download the SAML metadata (XML) from Okta.

8. Copy the X.509 Certificate and the Entry Point (SSO URL).

Retrieve the X.509 certificate and Entry Point from Okta.

9. Complete the Reemo SAML connector. Enable the connector (check Enabled) and click Update to save.

Enable the connector after pasting the Entry Point and Certificate from Okta.

Declare users

There are two approaches to grant SSO access to users.

Approach A: Explicit provisioning from the organization

From verified_user Admin Area > domain Organizations, select your organization, then go to inventory_2 Inventory > person Users and click New User > Provision SAML User to add users by entering their email.

Select Provision SAML User from the New User menu.

Add users by email through the provisioning popup.

Approach B: Just-In-Time (JIT) Provisioning

From verified_user Admin Area > domain Organizations, select your organization, then go to dashboard General > passkey SSO Connectors, click the connector then enable Just In Time Provisioning: accounts are created automatically on the first successful SSO login.

Enable Just In Time Provisioning to create accounts on first login.

Log in via SAML

Once the connector is active and users are declared (or JIT is enabled), your users can log in:

• General access to your portal (Private Cloud / On-Prem):

  https://[portal_url]/
  

• Direct access to the organization (Public Cloud):

  https://[portal_url]/login/[organization_shortname]
  

On the login screen, select the SSO tab, then click Login to be redirected to the identity provider.

Select the SSO tab, then click Login.