Okta as SAML IdP

Configure Okta as the SAML enterprise identity provider for Cross App Access (XAA). You’ll set up an Okta tenant, register the Resource and Requesting Apps in Okta, and configure a SAML enterprise connection that federates your Auth0 tenant with Okta.

​

Create and configure your Okta tenant

To create and configure your Okta tenant for Cross App Access:

• On the Okta Developer website, sign up for an Okta Integrator Free Plan. Once you sign up, you should be redirected to your new Okta tenant.
• If Cross App Access is not enabled in your Okta tenant, email developers@okta.com to request XAA enablement for your Okta tenant.

Once you’ve enabled Cross App Access, make sure the following features are toggled on under Okta Admin > Settings > Features in the Okta Admin Console.

​

Register the Requesting App in Okta

Configuring the Requesting App with SAML is not mandatory; it can also use OIDC. The following sections explain how to configure the Requesting App as a SAML application.

​

Create Requesting App in Okta

Your Requesting App is a standard SAML application. In the Okta Admin Console, go to Applications > Applications > Create App Integration and select SAML 2.0 as the Application type. Enter the application name and Single sign-on URL back to your web application. Once you’ve created the Requesting App, Okta assigns it SAML 2.0 metadata.

​

Assign Requesting App to Test Users

Allow your test user to log in to the Requesting App in Okta. In the Okta Admin Console:

1. Navigate to Applications and select the Requesting App you created.
2. Select Assign > Assign to People and select your test user.
3. Select Save.

​

Register the Resource App in Okta

​

Create Resource App in Okta

Similar to the Requesting App, your Resource App is a SAML 2.0 application.

1. Go to Applications > Applications > Create App Integration and select SAML 2.0 as the Application type.
2. Enter a connection name that you’ll reuse later when establishing the SAML connection between Okta and Auth0. Then, under Configure SAML:
   • Set the Single Sign On URL field to your Auth0 Tenant’s callback URL. Your callback URL will be https://{yourAuth0Domain}/login/callback?connection={yourConnectionName}.
   • Set the Audience URI (SP Entity ID) to urn:auth0:TENANT:CONNECTION format using the connection name.
   To learn more about SAML configuration values, read SAML Identity Provider Configuration Settings.
3. Select Next and Finish.

​

Assign Resource App to Test Users

Allow your test user to log in to the Resource App in Okta. In the Okta Admin Console:

1. Navigate to Applications and select the Resource App you created.
2. Select Assign > Assign to People and select your test user.
3. Select Save.

​

Enable Cross-app Access (XAA) in Resource App

Go to the Resource Server tab and enable Cross-app access (XAA) for the Resource App. Enter the Issuer URL of the Resource App’s authorization server: https://YOUR_AUTH0_DOMAIN/.

​

Register AI Agent in Okta

​

Create AI Agent

Go to Directory > AI Agents > Register AI Agent and select Register manually. Enter a name for your agent and assign an owner. At this stage, your AI Agent is STAGED. Before activating the agent, complete the following steps.

​

Add Agent Credentials

AI Agents authenticate on behalf of your applications with private key JWT. In the Credentials tab, select Add public key. You can either provide a public key of your own key pair or select Generate new key and download its private key and key ID (kid). Once you’ve set your credentials, a checkbox appears on the side of the tab.

​

Add Agent Delegations

In the Delegations tab, select Add Caller in the User sign-on section. Select the Requesting App, then select Add caller. Once you’ve set your agent delegations, a checkbox appears on the side of the tab.

​

Add Agent Resource connections

In the Resource connections tab, select Add resource connections and select Application as the Resource type. In the Application section, select the Resource App you created and set AI agent’s client ID registered in this app to the client_id of the Agent0 application in your Auth0 tenant. Once you’ve set your resource connections, a checkbox appears on the side of the tab.

​

Activate the Agent

From the Agent’s Actions drop down, select Activate and check that MANAGED STATUS is Active.

​

Configure a SAML Enterprise connection in Auth0

To create a SAML Enterprise connection in your Auth0 Dashboard, go to Authentication > Enterprise > SAML and select Create Connection. Copy the Sign In URL and X509 Signing Certificate from the Resource App’s Sign On tab. When creating the SAML Enterprise connection, activate the Cross App Access - Resource Application role. This enables your Resource App to accept ID-JAGs issued by the enterprise IdP associated with that connection, in this case, your Okta tenant. Since your connection is SAML, you also need to enter the OpenID Connect Issuer or discovery URL pointing to your Okta tenant. Use https://{yourOktaDomain} as the issuer URL. After creating the SAML Enterprise connection, check that the Single Sign-On URL provided by Auth0 in the connection’s settings matches the Redirect URI configured in the sign-on policies of the Resource App in your Okta tenant.

​

Test Connection in Auth0

In the Auth0 Dashboard:

• Navigate to Authentication > Enterprise > SAML:
• Enter the Enterprise SAML connection you created and select the Applications tab. Then, enable the Requesting App you created for the connection.
• Go back to the list of Enterprise SAML connections. Select the three dots on the right for your connection and select Try. You will be redirected to authenticate in your Okta tenant to complete the login with your test user.

• Log in with the user you assigned to XAA Resource App

• Verify user login was successful

Once the user successfully logs in with the federated connection, their user profile is created in Auth0.

​

Publish your Resource App in OIN

After you’ve configured and tested the end-to-end flow, B2B and SaaS providers can amplify their reach to enterprise customers by publishing their Resource App to the Okta Integration Network (OIN). To learn how, follow the instructions in How to Build and List Secure Cross App Access Connections on OIN.