Okta

Example values

The tenant-specific values (the sg_ab12cde parts) show the shape only — Safeguard displays your real ACS URL and SP Entity ID in the Add Provider dialog after you click Save. This table makes it unambiguous which value goes on which side.

In Okta — the SAML app / SP details (you enter these at the IdP):

In Safeguard — Add Provider → SAML 2.0 (you copy these from the IdP):

-----BEGIN CERTIFICATE-----
MIIDdDCCAlygAwIBAgIGAX...(full cert from your IdP)...P3B/k0SolrFYPo
-----END CERTIFICATE-----

1. In the Okta admin console, go to Applications → Create App Integration → SAML 2.0.
2. Name the app and continue to Configure SAML:
   • Single sign on URL: the ACS URL Safeguard shows after Save
   • Audience URI (SP Entity ID): the SP Entity ID Safeguard shows after Save
   • Name ID format: EmailAddress
   • Application username: Email
3. Under Attribute Statements (Okta labels this section "optional," but this row is required for Safeguard), add: Name email, Name format Unspecified, Value user.email. Okta's "Application username" setting above controls the Name ID, not this — Safeguard needs both.
4. Click Next, then Finish.
5. On the app's Sign On tab, click View SAML setup instructions (or download the Identity Provider metadata) to get the Identity Provider Single Sign-On URL, Identity Provider Issuer, and X.509 Certificate.
6. In Safeguard, click Add Provider → SAML 2.0 → Okta, and enter those three values.
7. Back in Okta, go to the Assignments tab and assign people or groups.
8. Click Test in Safeguard to confirm.

Common errors: users can authenticate at Okta but never appear correctly in Safeguard — check that Application username is set to Email, not a bare username. Sign-in works for you but not teammates — they haven't been added under the app's Assignments tab yet.