Skip to main content

SAML Setup for Okta SSO

To set up TrustLayer access via SSO in Okta using SAML, perform the following steps

Configure the app in Okta

  1. In the Okta admin console, go to Applications → Applications and click Create App Integration.

  2. Select SAML 2.0 and click Next.

  3. General Settings — App name: TrustLayer (logo optional), then Next.

  4. Configure SAML — fill in:

Field

Value

Single sign-on URL

https://auth.trustlayer.io/__/auth/handler

Use this for Recipient URL and Destination URL

✅ checked

Audience URI (SP Entity ID)

trustlayer.io

Name ID format

EmailAddress

Application username

Email

  1. Still under Configure SAML, add these Attribute Statements (Name format: Unspecified) so TrustLayer receives your users' names:

Name

Value

firstName

user.firstName

lastName

user.lastName

  1. Click Next, then Finish.

  2. Assign the app to your users or groups from the Assignments tab.

  3. On the Sign On tab, find the SAML Signing Certificates / metadata details and collect:

    • Identity Provider Issuer (Entity ID)

    • Sign-on URL (IdP Single Sign-On URL)

    • X.509 signing certificate (download)

Create the configuration in TrustLayer

  1. In TrustLayer, go to Settings → Single Sign-On (visible to workspace Owners) and click Create configuration.

  2. Select SAML 2.0 and fill in:

    • Entity ID → the Identity Provider Issuer (step 8)

    • Single sign-on URL → the IdP Sign-on URL (step 8)

    • Certificate → the downloaded X.509 certificate (step 8)

    • Domains → the email domain(s) you want SAML login for (e.g. yourdomain.com)

  3. Save, then verify each domain by adding the DNS TXT record shown on the page (record name @) and clicking Verify. DNS changes can take up to 48 hours to propagate.

  4. Once at least one domain is verified, go to the Activation card on the same page and click Turn on single sign-on. Verifying a domain proves that you own it; it does not switch single sign-on on by itself.

From then on, all users with emails on your activated domains will be redirected to Okta when they log in, and will be able to access TrustLayer if they have the app assigned. See Setting Up SSO (Single Sign-On) for how to add domains later or turn single sign-on off again.

Did this answer your question?