SSO with Okta
Prepare your Okta org before the SSO implementation call.
Before the call
Rilla uses Auth0 for authentication and supports enterprise SSO through Okta with SAML 2.0. Have these ready before the implementation call:
| What | Details |
|---|---|
| Email domains | Every domain your people sign in with, such as yourcompany.com. Rilla routes these domains to Okta on the sign-in page. |
| An administrator | An Okta Super Administrator or Application Administrator who can create the app, assign people to it and download its metadata during the call. |
| A SAML app | Created in your Okta org with the values below. |
Create a SAML app
In the Okta Admin Console, go to Applications → Applications → Create App Integration, pick SAML 2.0 and name the app Rilla. On the Configure SAML step, enter:
| Field | Value |
|---|---|
| Single sign-on URL | https://login.rilla.com/login/callback?connection=<connection>, with Use this for Recipient URL and Destination URL checked. |
| Audience URI (SP Entity ID) | urn:auth0:rilla:<connection> |
| Name ID format | EmailAddress |
| Application username |
<connection> is the name Rilla gives your connection, usually YourCompany-Okta. We send it to you before the call, and both values must use it exactly.
After saving, open the app's Sign On tab and keep the Metadata URL handy. It gives Rilla the sign-in URL and signing certificate in one step. Then assign the people or groups who should sign in to Rilla under Assignments.
Add attribute statements
Rilla reads the email from the Name ID. Names are optional, and Okta only sends them if you add attribute statements on the Configure SAML step:
| Name | Value |
|---|---|
given_name | user.firstName |
family_name | user.lastName |
Without the name statements, people sign in fine and an admin fills in names in Rilla, or SCIM does. Rilla doesn't read phone numbers, groups or other attributes from Okta.
What we do on the call
Together with Rilla, we will:
- Create the SAML app, if it isn't done yet
- Create the SAML enterprise connection in Auth0 from your metadata URL and enable it for Rilla
- Route your email domains to the connection
- Test the full SSO sign-in flow with an assigned user
- Troubleshoot any assignment or attribute issues
Good to know
- Rilla matches people to existing accounts by email. Until SCIM is on, someone assigned in Okta who has no Rilla account gets a Sales Rep account on first sign-in, and admins change roles and teams in Rilla afterwards. With SCIM on, Okta creates the accounts and sign-in alone doesn't.
- Once a domain is routed to Okta, everyone on it signs in through Okta. Passwords and email codes stop working for that domain.
- Okta's signing certificate is valid for ten years. Rilla reads it once from the metadata URL, so tell us if you rotate it.
For the technical details, see Auth0's SAML identity provider guide.
Next: sync users and teams with SCIM