Okta
Integrating Okta with env0 as a SAML provider
Introduction
This guide will detail the various steps required to integrate Okta as a SAML provider for your env0 organization. The current implementation supports SAML 2.0 and is used for authentication only, where you define your users in your Okta account to enable them access to your env0 organization. You can also add env0 as an application in your user application dashboard.
In addition, we also support group syncing of the logged in user to match those with env0 teams.
Steps
- Login to the Okta admin console
- Go to the
Applications > Applications
- Click on the
Add Application
button - Click on the
Create New App
button - Choose
Web
andSAML 2.0
and click on the Create button
- Set the application name to
env0
and upload a logo and click onNext
- In the
Single sign on URL
enterhttps://login.app.env0.com/login/callback?connection=YOUR_ENV0_ORG_ID
- In the
Audience URL (SP Entity ID)
enterurn:auth0:env0:YOUR_ENV0_ORG_ID
e.g.urn:auth0:env0:aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee
- In the
Name ID format
putUnspecified
- Click on the
Show Advanced Settings
- Change the
Assertion Encryption
to beEncrypted
and upload the PEM located here - Download the
Okta Certificate
, we will need it later on - In the
ATTRIBUTE STATEMENTS
add the following:
Name | Value |
---|---|
user.email | |
firstName | user.firstName |
lastName | user.lastName |
name | ${user.firstName} ${user.lastName} |
- Leave the rest of the default values and click
Next
- If you would like to set up groups as well you should do the following:
- In the
Group Attribute Statements (optional)
add and Attribute - The name should be teams and then set the filter according to what you wish. For example, to get all groups set a regex filter with the value of
(.*?)
Teams syncing
Teams will be synced each time a user logins with the following logic:
- env0 will create a new team if one doesn't exists based on the group name we received from the SAML provider.
- If the team exists in env0 we will not create a new team.
- We will assign the user to all the teams in env0 based on the group names he/she is part of in the SAML provider..
- If the user was removed from a group in the SAML provider we will remove him/her from the team in env0.
- Choose
Iâm an Okta customer adding an internal app
and click onFinish
. - In the
Sign on
Tab and click on theView Setup Instructions
button.
- Copy the
Identity Provider Single Sign-on URL
, then upload with theOkta Certificate
to https://www.env0.com/env0-setup-saml-single-sign-on
Updated 3 months ago