> ## Documentation Index
> Fetch the complete documentation index at: https://docs-staging.auth0-mintlify.app/llms.txt
> Use this file to discover all available pages before exploring further.

> Learn how to configure Okta as a SAML identity provider for Cross App Access (XAA).

# Okta as SAML IdP

<Warning>
  Cross App Access (XAA) for the Resource App is in **Early Access**. Enterprise, B2B Pro, and B2B Essential customers can use it as a feature of Enterprise Connections. You can also try it during the trial period on Free tenants. By using this feature, you agree to the applicable Free Trial terms in Okta's [Master Subscription Agreement](https://www.okta.com/legal/?_gl=1*51wq70*_gcl_au*NzczNzM1NjYyLjE3ODE3NzY0MDI.*_ga*MTE3ODU0MTY1Ny4xNzgxNzc2NDAy*_ga_QKMSDV5369*czE3ODQ1NTM3ODckbzgyJGcxJHQxNzg0NTU0NzIxJGo1OCRsMCRoMA..).
</Warning>

<Callout icon="file-lines" color="#0EA5E9" iconType="regular">
  This guide assumes you use Okta as your enterprise identity provider (IdP) and have administrative access to an Okta tenant you can use for testing. If you don’t have one, read [Create and configure your Okta tenant](/docs/ai-agents-mcp/cross-app-access/idp/okta-as-saml-idp#create-and-configure-your-okta-tenant).
</Callout>

Configure Okta as the SAML enterprise identity provider for Cross App Access (XAA). You'll set up an Okta tenant, register the Resource and Requesting Apps in Okta, and configure a SAML enterprise connection that federates your Auth0 tenant with Okta.

## Create and configure your Okta tenant

To create and configure your Okta tenant for Cross App Access:

* On the [Okta Developer website](https://developer.okta.com/signup/), sign up for an **Okta Integrator Free Plan**. Once you sign up, you should be redirected to your new Okta tenant.
* If Cross App Access is not enabled in your Okta tenant, email `developers@okta.com` to request XAA enablement for your Okta tenant.

Once you've enabled Cross App Access, make sure the following features are toggled on under **Okta Admin > Settings > Features** in the Okta Admin Console.

<Frame>
  <img src="https://mintlify.s3.us-west-1.amazonaws.com/docs-staging/docs/images/xaa/xaa_okta_flags_ea.png" alt="" />
</Frame>

## Register the Requesting App in Okta

Configuring the Requesting App with SAML is not mandatory; it can also use OIDC. The following sections explain how to configure the Requesting App as a SAML application.

### Create Requesting App in Okta

Your Requesting App is a standard SAML application. In the Okta Admin Console, go to **Applications > Applications > Create App Integration** and select **SAML 2.0** as the **Application type**.

<Frame>
  <img src="https://mintlify.s3.us-west-1.amazonaws.com/docs-staging/docs/images/xaa/xaa_okta_req_app_new_type_saml.png" alt="" />
</Frame>

Enter the application name and **Single sign-on URL** back to your web application.

<Frame>
  <img src="https://mintlify.s3.us-west-1.amazonaws.com/docs-staging/docs/images/xaa/okta_req_app_new_application_saml.png" alt="" />
</Frame>

Once you've created the Requesting App, Okta assigns it SAML 2.0 metadata.

<Frame>
  <img src="https://mintlify.s3.us-west-1.amazonaws.com/docs-staging/docs/images/xaa/xaa_okta_req_app_sign_on_saml.png" alt="" />
</Frame>

### Assign Requesting App to Test Users

Allow your test user to log in to the Requesting App in Okta.

In the Okta Admin Console:

1. Navigate to **Applications** and select the Requesting App you created.
2. Select **Assign > Assign to People** and select your test user.
3. Select **Save**.

<Frame>
  <img src="https://mintlify.s3.us-west-1.amazonaws.com/docs-staging/docs/images/xaa/xaa_okta_req_app_user_assignment_saml.png" alt="" />
</Frame>

## Register the Resource App in Okta

### Create Resource App in Okta

Similar to the Requesting App, your Resource App is a SAML 2.0 application.

1. Go to **Applications > Applications > Create App Integration** and select **SAML 2.0** as the **Application type**.
2. Enter a connection name that you'll reuse later when establishing the SAML connection between Okta and Auth0. Then, under **Configure SAML**:

   * Set the **Single Sign On URL** field to your **Auth0 Tenant’s callback URL**. Your callback URL will be `https://{yourAuth0Domain}/login/callback?connection={yourConnectionName}`.
   * Set the **Audience URI (SP Entity ID)** to `urn:auth0:TENANT:CONNECTION` format using the connection name.

   To learn more about SAML configuration values, read [SAML Identity Provider Configuration Settings](/docs/authenticate/protocols/saml/saml-identity-provider-configuration-settings).
3. Select **Next** and **Finish**.

<Frame>
  <img src="https://mintlify.s3.us-west-1.amazonaws.com/docs-staging/docs/images/xaa/xaa_okta_resource_app_details_saml.png" alt="" />
</Frame>

### Assign Resource App to Test Users

Allow your test user to log in to the Resource App in Okta.

In the Okta Admin Console:

1. Navigate to **Applications** and select the Resource App you created.
2. Select **Assign > Assign to People** and select your test user.
3. Select **Save**.

<Frame>
  <img src="https://mintlify.s3.us-west-1.amazonaws.com/docs-staging/docs/images/xaa/xaa_okta_resource_app_user_assignment_saml.png" alt="" />
</Frame>

### Enable Cross-app Access (XAA) in Resource App

Go to the **Resource Server** tab and enable Cross-app access (XAA) for the Resource App. Enter the **Issuer URL** of the Resource App's authorization server: `https://YOUR_AUTH0_DOMAIN/`.

<Frame>
  <img src="https://mintlify.s3.us-west-1.amazonaws.com/docs-staging/docs/images/xaa/xaa_okta_resource_app_resource_server_saml.png" alt="" />
</Frame>

<Callout icon="file-lines" color="#0EA5E9" iconType="regular">
  Auth0 issues and accepts tokens with an issuer URL that must end with the trailing forward slash **`/`**.
</Callout>

## Register AI Agent in Okta

### Create AI Agent

Go to **Directory > AI Agents > Register AI Agent** and select **Register manually**. Enter a name for your agent and assign an owner.

<Frame>
  <img src="https://mintlify.s3.us-west-1.amazonaws.com/docs-staging/docs/images/xaa/xaa_okta_register_ai_agent_saml.png" alt="" />
</Frame>

At this stage, your AI Agent is `STAGED`. Before activating the agent, complete the following steps.

<Frame>
  <img src="https://mintlify.s3.us-west-1.amazonaws.com/docs-staging/docs/images/xaa/xaa_okta_ai_agent_staged_saml.png" alt="" />
</Frame>

### Add Agent Credentials

AI Agents authenticate on behalf of your applications with [private key JWT](/docs/get-started/authentication-and-authorization-flow/authenticate-with-private-key-jwt). In the **Credentials** tab, select **Add public key**.

You can either provide a public key of your own key pair or select **Generate new key** and download its private key and key ID (`kid`).
Once you've set your credentials, a checkbox appears on the side of the tab.

<Frame>
  <img src="https://mintlify.s3.us-west-1.amazonaws.com/docs-staging/docs/images/xaa/xaa_okta_ai_agent_credentials_set_saml.png" alt="" />
</Frame>

### Add Agent Delegations

In the **Delegations** tab, select **Add Caller** in the **User sign-on** section.
Select the Requesting App, then select **Add caller**.

<Frame>
  <img src="https://mintlify.s3.us-west-1.amazonaws.com/docs-staging/docs/images/xaa/xaa_okta_ai_agent_delegations_assign_saml.png" alt="" />
</Frame>

Once you've set your agent delegations, a checkbox appears on the side of the tab.

<Frame>
  <img src="https://mintlify.s3.us-west-1.amazonaws.com/docs-staging/docs/images/xaa/xaa_okta_ai_agent_delegations_set_saml.png" alt="" />
</Frame>

### Add Agent Resource connections

In the **Resource connections** tab, select **Add resource connections** and select **Application** as the **Resource type**.

In the **Application** section, select the Resource App you created and set **AI agent's client ID registered in this app** to the `client_id` of the Agent0 application in your Auth0 tenant.

<Frame>
  <img src="https://mintlify.s3.us-west-1.amazonaws.com/docs-staging/docs/images/xaa/xaa_okta_ai_agent_resource_connections_tab_saml.png" alt="" />
</Frame>

Once you've set your resource connections, a checkbox appears on the side of the tab.

### Activate the Agent

From the **Agent's Actions** drop down, select **Activate** and check that **MANAGED STATUS** is **Active**.

## Configure a SAML Enterprise connection in Auth0

To [create a SAML Enterprise connection](/docs/authenticate/identity-providers/enterprise-identity-providers/saml) in your Auth0 Dashboard, go to **Authentication > Enterprise > SAML** and select **Create Connection**.

Copy the **Sign In URL** and **X509 Signing Certificate** from the Resource App's **Sign On** tab.

<Frame>
  <img src="https://mintlify.s3.us-west-1.amazonaws.com/docs-staging/docs/images/xaa/xaa_auth0_new_okta_saml_connection.png" alt="" />
</Frame>

When creating the SAML Enterprise connection, activate the **Cross App Access - Resource Application** role. This enables your Resource App to accept ID-JAGs issued by the enterprise IdP associated with that connection, in this case, your Okta tenant.
Since your connection is SAML, you also need to enter the OpenID Connect **Issuer or discovery URL** pointing to your Okta tenant. Use `https://{yourOktaDomain}` as the issuer URL.

<Frame>
  <img src="https://mintlify.s3.us-west-1.amazonaws.com/docs-staging/docs/images/xaa/xaa_auth0_connection_saml_xaa_enabled.png" alt="" />
</Frame>

After creating the SAML Enterprise connection, check that the **Single Sign-On URL provided by Auth0** in the connection's settings matches the **Redirect URI** configured in the sign-on policies of the **Resource App** in your Okta tenant.

<Callout icon="file-lines" color="#0EA5E9" iconType="regular">
  If you want third-party applications to access this connection only through Cross App Access, with access approved in Okta as the enterprise IdP, don't [promote it to the domain level](/docs/authenticate/identity-providers/promote-connections-to-domain-level). Promoting it makes the connection available to any third-party application in your tenant for standard login flows (`/authorize`), not just through Cross App Access.
</Callout>

### Test Connection in Auth0

In the Auth0 Dashboard:

* Navigate to **Authentication > Enterprise > SAML**:
* Enter the Enterprise SAML connection you created and select the **Applications** tab. Then, enable the Requesting App you created for the connection.
* Go back to the list of Enterprise SAML connections. Select the three dots on the right for your connection and select **Try**. You will be redirected to authenticate in your Okta tenant to complete the login with your test user.

<Frame>
  <img src="https://mintlify.s3.us-west-1.amazonaws.com/docs-staging/docs/images/xaa/xaa_auth0_try_saml_connection.png" alt="" />
</Frame>

* Log in with the user you assigned to XAA Resource App

<Frame>
  <img src="https://mintlify.s3.us-west-1.amazonaws.com/docs-staging/docs/images/xaa/xaa_okta_saml_login.png" alt="" />
</Frame>

* Verify user login was successful

<Frame>
  <img src="https://mintlify.s3.us-west-1.amazonaws.com/docs-staging/docs/images/xaa/xaa_auth0_saml_try_success.png" alt="" />
</Frame>

Once the user successfully logs in with the federated connection, their user profile is created in Auth0.

<Frame>
  <img src="https://mintlify.s3.us-west-1.amazonaws.com/docs-staging/docs/images/xaa/xaa_auth0_try_profile_saml.png" alt="" />
</Frame>

<Callout icon="file-lines" color="#0EA5E9" iconType="regular">
  Users must log in with a XAA-enabled enterprise connection at least once so that the user profile exists in Auth0.
  Auth0 does not support JIT user creation with ID-JAG at the moment.
</Callout>

## Publish your Resource App in OIN

After you've configured and [tested the end-to-end flow](/docs/ai-agents-mcp/cross-app-access/end-to-end-testing), B2B and SaaS providers can amplify their reach to enterprise customers by publishing their Resource App to the [Okta Integration Network (OIN)](https://www.okta.com/integrations/). To learn how, follow the instructions in [How to Build and List Secure Cross App Access Connections on OIN](https://developer.okta.com/blog/2026/07/06/submit-oin-xaa).