SAML Configuration
Kiplot supports Single Sign-On (SSO) using Okta as a SAML 2.0 Identity Provider (IdP).
Before starting the configuration, please contact your Kiplot Activation Lead. Kiplot will provide the Service Provider (SP) information required to configure the integration, including:
Single Sign-On URL / Assertion Consumer Service (ACS) URL
Audience URI / SP Entity ID
SAML Request Signature Verification certificate
1. Create a new application in Okta
Log in to the Okta Admin Console and navigate to:
Applications → Applications → Create App Integration
Select SAML 2.0 as the sign-in method and click Next. This is the standard Okta process for creating a custom SAML integration.
Enter Kiplot as the application name and continue to the SAML configuration.
2. Configure the SAML settings
Under SAML Settings, populate the following fields using the information provided by Kiplot:
Okta setting | Configuration |
Single sign-on URL | Use the Single Sign-On / ACS URL provided by Kiplot |
Use this for Recipient URL and Destination URL | Enabled |
Audience URI (SP Entity ID) | Use the Entity ID provided by Kiplot |
Default RelayState | Leave blank |
Name ID format | Persistent |
Application username | |
Update application username on | Create and update |
3. Configure Advanced Settings
Expand Advanced Settings and configure the following:
Setting | Value |
Response | Signed |
Assertion Signature | Signed |
Signature Algorithm | RSA-SHA256 |
Digest Algorithm | SHA256 |
Assertion Encryption | Unencrypted |
Enable Single Logout | Disabled |
Signed Requests | Enabled |
Assertion Inline Hook | None (disabled) |
Authentication context class | PasswordProtectedTransport |
Honor Force Authentication | Yes |
SAML Issuer ID | Leave as the Okta default |
Under Signature Certificate, upload the .cer certificate provided by Kiplot. This certificate is also included in the metadata XML file.
Ensure Validate SAML requests with signature certificates is selected.
Note: Assertion encryption is optional. Kiplot supports token encryption if required by your organisation's security policies.
4. Configure attribute statements
Kiplot requires the user's email address, first name and surname to be provided in the SAML assertion.
Configure the following Attribute Statements:
Name | Name format | Value |
emailaddress | Unspecified | user.email |
givenname | Unspecified | user.firstName |
surname | Unspecified | user.lastName |
name | Unspecified | user.email |
The user's email address is used to identify their Kiplot account. When a permitted user accesses Kiplot for the first time, their account is created using Just-In-Time (JIT) provisioning.
5. Complete the Okta application
Click Next.
When prompted for information about the application, select:
‘I'm an Okta customer adding an internal app’
and indicate that the application is an internal application.
Click Finish to create the integration. Okta's current App Integration Wizard uses this flow for private SAML applications that are not being submitted to the Okta Integration Network.
6. Provide the Okta metadata to Kiplot
Once the application has been created:
Open the Sign On tab for the Kiplot application.
Locate Metadata details.
Copy the Metadata URL.
Share the Metadata URL with your Kiplot Activation Lead.
The URL will look similar to:
https://{your-okta-domain}/app/{application-id}/sso/saml/metadata
This metadata allows Kiplot to configure Okta as the Identity Provider and contains the information required to establish trust with your Okta environment. Okta makes this available from the application's Sign On configuration.
7. Assign users to Kiplot in Okta
This step is completed within Okta and may differ depending on your organization’s internal access policies.
Within the Kiplot application in Okta, open the Assignments tab.
Assign the appropriate users or groups who should be permitted to access Kiplot.
Only users assigned to the Kiplot application will be able to authenticate through the integration.
8. Test the integration
Once the Metadata URL has been provided, Kiplot will complete the configuration on our side.
Please provide details of at least one test user who:
Has been assigned to the Kiplot application in Okta
Has a valid email address, first name and surname in Okta
Is permitted to access the Kiplot environment
Kiplot will confirm when the SSO configuration is ready for testing.