Skip to main content

Okta <> Enterpret: End-to-End SSO Setup Guide (SAML)

Configuring Okta SAML Application to sign-in to Enterpret

Team Enterpret avatar
Written by Team Enterpret
Updated yesterday

Overview

Single Sign-On (SSO) allows users to log in to Enterpret using their organization’s existing Okta credentials. Enterpret supports SAML 2.0–based SSO, enabling centralized authentication, improved security, and simpler user access management.

This guide walks you through the entire SSO setup flow, from configuring Okta to testing and enforcing SSO.

🔐 Understanding SSO Login Flows (Read This First)

Most SSO issues come from confusion between where the login starts. Enterpret supports both flows below, but they behave differently.

SP-Initiated SSO

What it is

  • Login starts from Enterpret

  • User is redirected to Okta to authenticate

Flow

  1. User opens Enterpret login page

  2. Clicks Sign in with SSO

  3. Redirected to Okta

  4. Authenticates

  5. Redirected back to Enterpret

Why this matters

  • ✅ No RelayState required

  • ✅ Simplest flow

  • ✅ Must work before enforcing SSO

👉 Always validate this flow first.

IDP-Initiated SSO

What it is

  • Login starts from Okta

  • User clicks Enterpret app in Okta dashboard

Key difference

  • ❗ Requires RelayState

  • Without it, Enterpret can’t identify the correct workspace

What Is RelayState?

RelayState is a value generated by Enterpret that tells the Okta:

“This user belongs to this specific Enterpret workspace.”

  • SP-initiated: Not required

  • IDP-initiated: Required

Prerequisites

  • Admin access to Enterpret

  • Admin access to Okta

  • Permission to create Okta applications

  • User emails in Enterpret must exactly match Okta emails

High-Level Setup Flow

  1. Create a SAML app in Okta

  2. Configure attribute statements (important)

  3. Configure SSO in Enterpret

  4. Test SP-initiated login

  5. Enable IDP-initiated login

  6. (Optional) Enforce SSO

Step 1: Configure Okta for Enterpret (SAML)

1. Create a New Application

  1. Okta Admin Console → Applications → Applications

  2. Click Create App Integration

  3. Select SAML 2.0

2. General Settings

  • App name: Enterpret Inc

  • Logo: Optional [you can upload the Enterpret logo, which you can find it here]

  • Click Next

3. Configure SAML Settings

  • Update SAML Settings with following details

Field

Value

Single sign-on URL (ACS)

https://enterpret-prod.auth.us-east-2.amazoncognito.com/saml2/idpresponse

Audience URI (SP Entity ID)

urn:amazon:cognito:sp:us-east-2_kLiRrPBis

Default RelayState

Leave empty

Name ID format

EmailAddress

Application username

Email

Update application username on

Create and Update

  1. Click on Next

  2. Give Okta Feedback (Optional)

4. Configure Attribute Statements

  • Open Enterpret Application’s Sign On tab

  • Scroll down to Attribute Statements and expand Show Legacy Configuration

  • Add following attribute to Profile attribute statements as shown above

Name

Name format

Value

email

Unspecified

user.email

  1. Leave Group attribute statements empty and Save

5. Copy Okta Metadata URL

  1. Open Enterpret Inc app

  2. Go to Sign On

  3. Copy the Metadata URL

Step 2: Configure SSO in Enterpret

  1. Log in to Enterpret

  2. Click Organization logo → Settings → Access Settings → SSO & SCIM Settings

  3. Click Configure

  4. Select SAML

  5. Paste the Metadata URL

  6. Click Submit

Step 3: Attach Enterpret Application to Users in Okta

  1. Go to Admin Console → Directory → People

  2. Select User

  3. Click on Assign Applications

  4. Assign Enterpret Inc and click on Done

Step 3: Test SP-Initiated SSO

  1. Log out of Enterpret

  2. Go to Enterpret login page

  3. Click Sign in with SSO

  4. Enter your email

  5. Authenticate via Okta

Step 4: Enable IDP-Initiated Login

  1. Get RelayState from Enterpret

    • Click Organization logo → Settings → Access Settings → SSO & SCIM Settings

    • Copy RelayState

  2. Add RelayState in Okta

    • Okta → Enterpret app

    • General → SAML Settings → Edit

    • Paste into Default RelayState

    • Save

    • Goto My Apps and click on Enterpret App

Step 5: (Optional) Enforce SSO

Only after testing:

  • Click Organization logo → Settings → Access Settings → SSO & SCIM Settings

  • Toggle Enforce SSO

⚠️ Enforcing without testing can lock you out.

Troubleshooting Checklist

Before reaching out for support, double-check the following:

  • Emails match exactly in Okta and Enterpret

  • email attribute exists and maps to user.email

  • User is assigned to the Enterpret app in Okta

  • SP-initiated login works (Sign in with SSO from Enterpret)

  • Metadata URL is valid and up to date

  • RelayState is configured in Okta (required for IDP-initiated login)

FAQs

  1. Why does SSO fail even though Okta shows a successful login?

    This usually happens for one of two reasons:

    • The email attribute is missing or mapped incorrectly

    • The user is using IDP-initiated login (Okta dashboard) and RelayState is not configured

    Even if Okta authenticates the user successfully, Enterpret still needs:

    • A valid email attribute to identify the user, and

    • RelayState (for IDP-initiated flows) to identify the correct workspace

  2. SSO works from Enterpret, but not when clicking the Okta app. Why?

    This is almost always due to a missing RelayState.

    • SP-initiated login (from Enterpret) does not require RelayState

    • IDP-initiated login (from Okta) does require RelayState

    Without RelayState, Enterpret doesn’t know which workspace the user should be logged into.

  3. Is NameID enough? Why do we still need the email attribute?

    No. NameID alone is not sufficient.

    Enterpret explicitly reads the email attribute from the SAML response to:

    • Identify the user

    • Match them to an existing account

    If the email attribute is missing or incorrect, login will fail even if NameID is present.

  4. Can we map a different attribute instead of email?

    No. Enterpret currently uses email as the unique identifier for users.

  5. Do group attributes affect login?

    No. Group attributes:

    • Are not required for authentication

    • Can be left empty

    • Should be managed via SCIM, not SAML

  6. What should we test before enforcing SSO?

    Before turning on Enforce SSO, verify:

    • ✅ SP-initiated login works

    • ✅ Email attribute mapping is correct

    • ✅ At least one admin can log in successfully

    • ✅ (If using Okta dashboard access) RelayState is configured

  7. What Are Attribute Statements?

    Attribute statements define what user information Okta sends to Enterpret during login.

    Enterpret relies on these attributes to:

    • Identify the user

    • Match them to an existing Enterpret account

    • Grant access to the correct workspace

    If attribute statements are missing or misconfigured, SSO will fail even if the rest of the setup looks correct.

    Why the Email Attribute Matters

    • Enterpret uses the email claim as the unique identifier

    • During login, Enterpret checks:

      • “Does this email already exist in this workspace?”

    If the email:

    • Is missing

    • Is mapped incorrectly

    • Uses a different format (aliases, domains, casing)

    ➡️ The user will not be able to log in

    Common Attribute Statement Mistakes

    ❌ Attribute not added at all

    ❌ Attribute name is not exactly email

    ❌ Value mapped to something other than user.email

    ❌ Emails differ between Okta and Enterpret

    ✅ Correct mapping prevents the majority of SSO login issues

    Group Attribute Statements

    • Not required for SSO

    • Can be left empty

    • SCIM should be used for user and role management instead

Need Help?

If you’re unsure whether:

  • Attribute statements are configured correctly, or

  • RelayState is missing for IDP-initiated login

Reach out to the Enterpret team — we’re happy to help you get SSO working smoothly 🚀

Related Articles
Using Single Sign-on (SSO)
User De-provisioning with Okta SSO
Configure SCIM 2.0 with Okta
Okta <> Enterpret: End-to-End SSO Setup Guide (OIDC)
Azure AD (Microsoft Entra ID) <> Enterpret: End-to-End SSO Setup Guide (SAML)
Did this answer your question?