imper.ai

Appearance

Okta SAML Configuration

Configure Single Sign-On with Okta using the SAML protocol, with optional SCIM provisioning for automated user lifecycle management.

The setup runs across the two steps of the imper.ai Single Sign-On (SAML) Configuration dialog: first you copy the service provider details and register imper.ai in Okta, then you import the Okta metadata back into imper.ai. Once the application exists, you add the attribute statements and assign users to it.

Prerequisites ​

  • An Okta administrator role that can create application integrations (Super Administrator, or Application Administrator).
  • imper.ai administrator access to Settings > Organization Settings.

Step 1: Configure your Identity Provider ​

  1. In imper.ai, navigate to Settings > Organization Settings, and in the Configure SSO section click Set Up.
  2. Select Okta as your identity provider.
  3. Under Add imper.ai to your identity provider, copy both values using the Copy buttons:
    • Entity ID
    • Single sign-on URL

TIP

Leave this dialog open. You create the Okta application next, then return here and click Continue to finish.

Step 2: Create the SAML application in Okta ​

  1. In the Okta Admin Console, navigate to Applications > Applications and click Create App Integration.
  2. Select SAML 2.0 and click Next.
  3. Under General Settings, set the App name to imper.ai. Optionally upload a logo, then click Next.
  4. Under Configure SAML, enter the values you copied from imper.ai:
    • Single sign-on URL - paste the Single sign-on URL.
    • Audience URI (SP Entity ID) - paste the Entity ID.
  5. Set Name ID format to EmailAddress.
  6. Set Application username to Email.
  7. Click Next, complete the Feedback screen, and click Finish.

Step 3: Add Identity Provider Metadata ​

  1. In the new imper.ai application in Okta, go to the Sign On tab.
  2. Copy the Metadata URL. It looks like https://<org>.okta.com/app/<id>/sso/saml/metadata.
  3. Return to the imper.ai dialog and click Continue to reach Add Identity Provider Metadata.
  4. Paste the URL into the Okta Metadata URL field.
  5. Click Done to save the configuration.

TIP

To also automate user lifecycle management, turn on Enable SCIM provisioning on this screen before clicking Done. See SCIM Provisioning below.

Attribute Statements ​

In the imper.ai application, go to the Sign On tab and add the following expressions to Attribute Statements:

NameValue
nameuser.profile.firstName + " " + user.profile.lastName
firstNameuser.profile.firstName
lastNameuser.profile.lastName

Assigning Users and Groups ​

Regardless of whether SCIM is configured, you must navigate to the Assignments tab of the imper.ai application and assign the relevant people or groups so they can access imper.ai.

SCIM Provisioning ​

When Okta is configured as your SSO provider, you can optionally enable SCIM provisioning to automate user lifecycle management - including user creation, updates, and deprovisioning - directly from Okta.

NOTE

SCIM provisioning requires a completed Okta SAML configuration. Enable SAML first before activating SCIM.

Enabling SCIM ​

First, generate the SCIM credentials in imper.ai:

  1. In the Configure SSO section, click Edit to reopen the SSO configuration dialog, and go to the Add Identity Provider Metadata step.
  2. Turn on the Enable SCIM provisioning toggle.
  3. Copy the SCIM Base URL - for example, https://api.descope.com/scim/v2.
  4. Copy the SCIM Token. You need both values to configure the SCIM integration in Okta.

Then apply them in Okta:

  1. Open the imper.ai application and navigate to the Provisioning tab.
  2. Paste the SCIM Base URL into the SCIM connector base URL field.
  3. Paste the SCIM Token into the API token field.
  4. Uncheck Import Groups.
  5. Click Test API Credentials to verify the configuration, then click Save.

NOTE

The SCIM Token is displayed only once per generation. If you lose it, you must disable and re-enable SCIM provisioning to generate a new token, then update the value in Okta.

Configuring SCIM in Okta ​

To take full advantage of SCIM synchronization between Okta and imper.ai, open the Provisioning tab and enable the Create Users, Update Users, and Deactivate Users actions.

Copyright © Imper AI