--- title: "How To Configure Single Sign-On (SSO) using Okta Identity Management" url: "https://dm0bkdes5q7a2ls.productfruits.help/en/article/how-to-configure-single-sign-on-sso-using-okta" language: "en" last_updated: "2025-12-05T18:06:56.163Z" --- # How To Configure Single Sign-On (SSO) using Okta Identity Management This article describes how to set up Single Sign-on (SSO) in Spirion Sensitive Data Platform using Okta ## Before You Start ### Required Fields - When filling out user mapping the fields **Id**, **Username**, and **Email** all show a red star next to them to indicate these are required fields. - **Contact email**, **first name**, and **last name** are also required fields. - Do not click the slider to enable Single Sign On until you are finished with this process. > [Okta](https://www.okta.com/solutions/iam-identity-and-access-management/) is a cloud-based identity and access management (IAM) company that provides a platform to manage user identities and control access to applications and resources. It helps organizations secure their systems by verifying user identities, automating user lifecycles, and providing features like single sign-on (SSO) and multifactor authentication (MFA) to improve security and productivity.  ## How to Set Up Single Sign-On (SSO) with Okta ### How to Enable the Module Procedure: 1. In Spirion Sensitive Data Platform, in the blue navigation menu on the left side of the page, navigate to **Settings > User Management > Single Sign On**. ![](https://cdn-assets.productfruits.com/d638290b-98bd-434b-af15-698a96f711d3) 2. At the top of the page, set the **Enable Single Sign On** slider to the left - disabled (grey) - until the very end of the process.  1. This setting enables and disables SSO functionality. 2. We recommend leaving this disabled until all settings are configured. 3. Select the blue **Edit** button on the bottom right of the screen to configure Single Sign On with Okta. ## How to Set Up an Okta App Procedure: 1. Navigate to your Okta admin page. 2. Select **Applications** from the left and side of the screen. 3. Select create new app integration. 4. Select the **SAML 2.0** radio button from the list in the pop-up menu. ![](https://cdn-assets.productfruits.com/08252aeb-b8bb-4b9b-b02e-d958eca44bf7) 5. Click **Next**. 6. Enter a name for the SAML Integration App. 1. In this example, we are using **SpirionSSO**. 2. You may add a logo and hide the app on this screen if you wish. 7. Click **Next**. 8. Open the Sensitive Data Platform console in another browser window. 9. Navigate to Settings > User Management > Single Sign On. 10. Copy out the URL from the **Entity ID** section. ![](https://cdn-assets.productfruits.com/66c34596-132e-469d-a99b-07f13a86ab8e) 11. Paste the URL into the **Single sign-on URL** box and add `/ACS` to the end of the URL. ![](https://cdn-assets.productfruits.com/62e66327-6360-4b67-97c0-cb2bbae7be4d)  12. Paste the URL again into the **Audience URI** field.  ![](https://cdn-assets.productfruits.com/b50fc00a-0289-450e-84dd-5d4592ea11fd)   13. Other settings can remain as default. However, some organizations may require these settings to be filled in in a specific way. Consult your Okta Admin just in case. ## How to Map Okta Data to Spirion Sensitive Data Platform SSO Okta breaks up the data mapping into two sections. - **Section One** is the Attribute statements - **Section Two** is for Groups ### Attribute Statements The following table shows the matching of the attributes from the Spirion Console to Okta. These mappings can change from organization to organization with exception of **ID URI** which must be [http://schemas.microsoft.com/identity/claims/objectidentifier](http://schemas.microsoft.com/identity/claims/objectidentifier) and must be mapped to [user.id](http://user.id/) as shown in the bottom filed. When filling out the Okta Statements the **URI** goes in the name field, the **Name Format** is always going to be **URL Reference**, and the **Value** is from the column **Okta Value** in the table below. Below the table is an example entry. | Sensitive Data Platform Console Attribute Name | URI of the Attribute
(Name field on the Okta Attribute Statement screen) | Okta Value | | --- | --- | --- | | **Id** | http://schemas.microsoft.com/identity/claims/objectidentifier | user.id | | **Username** | http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier | User.displayname | | **Email** | http://schemas.microsoft.com/ws/2008/06/identity/claims/emailaddress | user.email | | **Contact Email** | http://schemas.microsoft.com/ws/2008/06/identity/claims/emailaddress | user.email | | **First Name** | http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname | user.firstName | | **Last Name** | http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname | user.lastName | | **Phone Number** | http://schemas.microsoft.com/ws/2008/06/identity/claims/phone | user.primaryPhone | | **Department** | http://schemas.xmlsoap.org/ws/2005/05/identity/claims/department | user.department | | **Position** | http://schemas.microsoft.com/identity/claims/jobtitle | user.title | | **Address** | http://schemas.microsoft.com/ws/2008/06/identity/claims/location | user.postalAddress | **Example Entry** ![](https://cdn-assets.productfruits.com/dd8182c4-027a-4c92-bd1c-4f8315419cad) ### Group Attribute Statements The only attribute that goes into the **Group Attribute Statement** is for Spirion user **Roles**.  The URI that populates the names field for this is: [http://schemas.microsoft.com/ws/2008/06/identity/claims/groups](http://schemas.microsoft.com/ws/2008/06/identity/claims/groups) - The filter is for the Group(s) that your organization set up in Okta that it would like to have access to Spirion Sensitive Data Platform (SDP). - You can have more than one filter. - For roles to be assigned to Users in Spirion Sensitive Data Platform they must be a part of an OKTA group that has been assigned to the SSO app.   - For example, if you already have a group created that you want to use, just assign them to the SSO app, or create a new group and add it to the SSO app.   - Every user added to the group inherits those permissions.   1. Next, define the group settings by picking a filter that will be easiest to associate to your groups.   - The options are as follows: - **Starts with** - **Equals** - **Contains** - **Matches regex** - For more information on Groups and mapping see: [Define group attribute statements | Okta Identity Engine](https://help.okta.com/oie/en-us/content/topics/apps/define-group-attribute-statements.htm) Group Attribute Example ![Group Attribute Statements (optional) pop-up box](https://cdn-assets.productfruits.com/5dd53308-1c4a-4a69-9c84-8eb76228544e) - Once this is complete, click **Next**. ## Feedback This page is optional and not required. - However, support recommends putting this guide in the **supported documentation** box just in case you need it for future reference. - Select the radial button that this is an internal app and click **Finish**. ## How to Link Okta with Spirion Sensitive Data Platform Procedure: 1. In Okta, on the left side navigation menu, click **Applications**. 2. Click the Application made in the previous section. - In our example, it would be called *SpirionSSO* 3. Click **Sign On** from the ribbon in the middle of the screen. 4. Click the blue **Copy** link under the Metadata URL in the **SAML 2.0** box under **Settings**. ![](https://cdn-assets.productfruits.com/b1239df4-6c03-4f49-8604-67baab357429) 5. Paste this URL into the box under **Identity Provider Metadata** in the Sensitive Data Platform console. ![](https://cdn-assets.productfruits.com/c27434eb-ac3e-435f-bd62-b6ba70cc5022) ## How to Configure Roles The **Roles Configuration** section maps Okta *directory groups* to Spirion Sensitive Data Platform user *Roles*. - To configure this section, refer to the Group Attribute that was set up under the **Group Attribute Statements** section. 1. Select the Spirion Sensitive Data Platform **Role** from the combo box on the left  2. Type the Okta Group name into the box on the right. 3. If you have more than one group do this for EACH Okta Group that was specified under the **Group Attribute Statements**. ![](https://cdn-assets.productfruits.com/3bd6c518-43b3-4fab-a5b0-5d9cb4647570) ## How to Complete Single Sign-On in Spirion Sensitive Data Platform Procedure: 1. Once all fields in the sections above are finished click **Save**. 2. Slide the bar for **Enable Single Sign On** to the right so that it is blue 3. Single Sign-On configuration with Okta is now complete.