Okta SAML SSO

Okta is an Identity Provider (IdP) that enables secure single sign-on (SSO), allowing your company’s users to access multiple applications with one login. With Security Assertion Markup Language (SAML) SSO, employees sign in once using their company credentials (typically email and password). The IdP, such as Okta, verifies their identity and grants seamless, secure access to all connected services, without requiring separate logins for each application. Company owners or IT administrators can link their organization’s email domain (e.g., @mycompany.com) to the IdP so that anyone with a company email address is automatically recognized and can securely sign in to SAML-enabled tools. Using Sevalla SAML SSO, you can connect Okta to Sevalla by creating a SAML application within Okta, verifying your company’s email domain, and adding the required Okta details in Sevalla. This allows your team to log in with their existing company credentials, eliminating the need to create or manage separate Sevalla accounts.

​

Enable SSO in Sevalla

When you set up SAML SSO, you can navigate away from the SSO setup at any stage to store your progress and return later. In Sevalla, go to your Company settings > Single sign-on, and click Enable. Read through the introduction, which explains how SSO will be set up, and click Continue. The next page provides all the information you need to set up your SAML app within Okta.

​

Set up the app integration in Okta

In Sevalla, the Create SAML app tab provides all the information you need to set up your SAML app within Okta. The following steps explain where to add this information. Log in to Okta as a user with admin access, and within the Admin Dashboard, click Applications > Create App Integration. Select SAML 2.0 as the sign-in method and click Next. Enter the App name from Sevalla. You can also download the App icon from Sevalla and upload this to the App logo, if required. Click Next. Complete the Configure SAML in Okta as follows:

• Single sign-on URL: Copy and paste the SSO/ACS URL from Sevalla.
• Audience URI (SP Entity ID): Copy and paste the Entity ID from Sevalla.
• Name ID format: EmailAddress
• Application username: Email
• Update application username on: Create and update

Leave all other fields as default and click Next. On the Feedback tab, select This is an internal app that we have created and then click Finish. You now need to set up the SAML app within Sevalla.

​

Map your Okta attributes

Within Okta, you must map the firstName, lastName, and email attributes from Sevalla to the correct fields within Okta. For more information about how to do this, refer to the Okta docs.

​

Assign users to the Okta app

In Okta, go to Applications, select the application you set up for the Sevalla Dashboard, and click Assignments. Click Assign and then click Assign to People. If you have your users set up in groups, click Assign to Groups. Click Assign on each user or group you want to assign to the Sevalla SAML SSO application and then click Done. To test authentication, make sure the Sevalla user account you’re signed in with is assigned.

​

Sevalla setup

In Sevalla, on Create SAML app, click Continue so that you are on the Sevalla setup page.

​

Email domain

In the Domain name, enter the email domain users will use to sign in using SAML SSO, and click Add domain. Only Sevalla accounts with an email address matching the verified domain can authenticate via SAML. For example, if SAML is enabled for example.com, only users with an @example.com email address will be able to sign in for that company. If the domain has already been verified in Sevalla through DNS management or as a site domain, it will automatically be verified. If it hasn’t, you’ll be prompted to add a TXT record to your DNS management service to confirm domain ownership. Because DNS changes can take time to propagate, you can navigate away from the SSO setup to store your progress and return later.

​

Set up Sevalla SAML

In Okta, go to Applications, select the application you set up for the Sevalla Dashboard, click Sign On, and then clickView SAML setup instructions . This page provides all the information you need to set up SAML in Sevalla. In Sevalla, within the Single sign-on Sevalla setup tab, complete the fields as follows:

• SSO URL: Copy and paste the Identity Provider Single Sign-On URL from Okta.
• Entity ID: Copy and paste the Identity Provider Issuer from Okta.
• Public certificate: Copy and paste the X.509 Certificate from Okta.

Click Continue.

​

Test the authentication in Sevalla

You cannot enable SAML SSO within Sevalla without first testing the authentication. In Sevalla, within Single sign-on, click Continue until you are on the Test and finish tab, and click Test authentication. A notification appears if the test was successful or if the test fails. If the test fails, click Back and check your SAML settings within your IdP and within Sevalla. If the test is successful and you want to enable SAML, click Save and set SSO live. Your Sevalla company users will now be able to sign in with SAML SSO or by entering their username and password. Users who sign in through an IdP are not required to complete Sevalla’s 2FA, as authentication is handled directly by the IdP. If you want to force users to sign on via SAML, you can enable Mandatory SSO and add Exceptions. You can also enable JIT provisioning to allow users authorized by your IdP to access your Sevalla company without requiring an invitation.

​

Change the session duration

Your Identity Provider (IdP) determines how long your SSO session remains active and when it expires. If your IdP doesn’t specify a session duration, Sevalla defaults to a 24-hour session. When your SSO session expires, you’ll be logged out of SSO. If you’re working within a company that uses SSO, you’ll be prompted to reauthenticate. If you have access to multiple companies in Sevalla, you’ll remain logged in overall but will need to reauthenticate before accessing any company that requires SSO. For details on adjusting session duration, refer to the Okta Help Center.