Okta SAML

Okta SAML
Prev	Access management	Next

The following manual configuration creates a SAML SSO configuration for your Enterprise organization.

Prerequisites

Owner or admin role in an Enterprise organization
Service provider certificate and private key that you create

Supported features

This configuration supports the following:

Service Provider initiated SSO
Single Log Out [optional]

Configuration steps

Before configuring SSO, you need to assign a namespace and create a Service Provider certificate and private key. These important steps provide information you need to enter later.

Create your namespace:

Go to Organization > SSO.
Under Namespace, enter the namespace you want for your organization. For example, acme_corp. Your organization members enter this namespace when they log in via SSO.
Under SSO type, select SAML 2.0.

Convert your Make Service Provider certificate into a .pem file:

Find the certificate under Service Provider Certificate.
Highlight and copy all of the certificate.
Paste the certificate into a plain text editor.
1. Windows: use Notepad.
2. Mac OS: use TextEdit.

Save the file as a .pem file

	Caution
	You may need to select *All files ( .* )** or rename the file after saving to change the extension to `.pem`.

This creates one .pem file. Locate the .pem file and have it ready to upload into Okta later.

Steps on Okta

Log in to Okta and go to Admin > Applications > Applications.
Click Create app integration and select SAML 2.0.
Name your app and upload your icon.
Click Next.

Configure the following SAML settings:

Single sign-on URL	You can find this URL in the Redirect URL field of the SSO configuration in your Make organization. Be sure to replace {namespace} with your actual namespace. Example: `https://www.make.com/sso/saml/examplenamespace`
Audience URI (SP Entity ID)	Add `/metadata.xml` to the URL in the Redirect URL field of the SSO configuration in your Make organization. Example: `https://www.make.com/sso/saml/examplenamespace/metadata.mxl`
Default RelayState	Leave this field blank
Name ID format	Select EmailAddress
Application username	Select Okta username
Update application username on	Select Create and update

Click Show advanced settings and enter the following:

Response

Select Signed

Assertion signature

Select Signed

Signature algorithm

Select RSA-SHA256

Digest algorithm

Select SHA256

Assertion encryption

Select Unencrypted

Note

Optional

If you want to encrypt assertions, you can select Encrypted and enter the following:

Encryption algorithm	AES256-CBC
Key transport algorithm	RSA-OAEP
Encryption certificate	Upload the `.pem` file you created earlier.

Signature certificate

Upload a .pem file of the Service Provider Certificate. This must be the same certificate as the Service Provider Certificate field of your Make SSO configuration tab.

Enable Single Logout

Leave unchecked

Signed requests

Optional

Other requestable SSO URLs

Optional

Assertion inline hook

Select None (disable)

Authentication context class

Select PasswordProtectedTransport

Honor force authentication

Select Yes

SAML issuer ID

http://www.okta.com/${org.externalKey}

Enter the following attributes and click Next.

Name	Name format	Value
profileFirstName	Unspecified	user.firstName
profileLastName	Unspecified	user.lastName
email	Unspecified	user.email

Select the following options and click Finish.

Are you a customer or partner?	Select I'm an Okta customer adding an internal app
App type	Select This is an internal app that we have created

To locate your IdP login URL and certificate:

Go to Admin > Applications > Applications and select your SAML SSO app. to access the necessary information.
Go to the Sign on tab and click View SAML setup instructions.

Steps on Make

Go to Organization > SSO.

Enter the following information from Okta into the IdP login URL and Identity provider certificate fields.

Field on Okta	Field on Admin > System settings
Identity provider single sign on URL	IdP login URL
X.509 certificate	Identity provider certificate

Enter the following in the Login IML resolve field:

{"email":"{{get(user.attributes.email, 1)}}","name":"{{get(user.attributes.profileFirstName, 1)}}
{{get(user.attributes.profileLastName, 1)}}","id":"{{user.name_id}}"}

Select the following settings:

Allow unencrypted assertions	Yes
Allow unsigned responses	No
Sign requests	Yes

Click Save.

Service Provider initiated SSO

Go to {{Make}}'s login page.
Click Sign in with SSO.
Enter the namespace you chose for your organization.
Log in using your Okta credentials and consent to {{Make}}'s access to your user data.

Troubleshooting

When you save the SSO configuration, you automatically receive an email with a link to bypass SSO login. Use this link to log in and adjust your configuration as needed.