Create an Identity Provider in Okta

To connect your org to the Identity Provider, add and configure that Identity Provider in Okta.

1. From the Developer Console, hover over Users and then select Social & Identity Providers from the menu that appears. If you are using the Admin Console (Classic UI), hover over Security and then select Identity Providers.

Note: See the Identity Providers API for request and response examples of creating an Identity Provider in Okta using the API.

2. Select Add Identity Provider and then select the appropriate Identity Provider.

3. In the Add an Identity Provider dialog box, define the following:

   • Apple
   • Azure AD
   • Facebook
   • Google
   • LinkedIn
   • Microsoft
   • Okta-to-Okta
   • OpenID Connect
   • SAML 2.0

   In the General Settings section:

   • Name — Enter the name that you would expect to see on a button, such as Sign in with SAML 2.0.

   In the Authentication Settings section:

   • IdP Username — This is the expression (written in the Okta Expression Language) that is used to convert an Identity Provider attribute to the application user's username. This Identity Provider username is used for matching an application user to an Okta User.

     For example, the value idpuser.email means that it takes the email attribute passed by the social Identity Provider and maps it to the Okta application user's username property.

     You can enter an expression to reformat the value, if desired. For example, if the social username is john.doe@mycompany.com, then you could specify the replacement of mycompany with endpointA.mycompany to make the transformed username john.doe@endpointA.mycompany.com. See Okta Expression Language for more information.

   In the SAML Protocol Settings section:

   Note: When you are setting up the IdP in Okta, sometimes the Issuer, Single Sign-On URL, and Certificate aren't available from the external IdP until the metadata (the Assertion Consumer Service URL (ACS URL) and Audience URI) is uploaded to the IdP. And, the ACS URL and Audience URI values aren't available until the IdP in Okta is configured.
   
   We recommend that if the external IdP requires information from Okta for setup before you have that information, enter any text for the IdP Issuer URI and enter https:url for the IdP Single Sign-On URL. After you upload the metadata to the external IdP in the next step, you can edit the IdP in Okta and enter the appropriate IdP Issuer URI, IdP Single Sign-On URL, and Certificate information.

   • IdP Issuer URI — The issuer. The Identity Provider provides this value.

   • IdP Single Sign-On URL — The sign-on URL from the Identity Provider. If you sign the authN request by selecting the Request Signature option, but don't specify a destination in the Destination field (see Advanced Settings), Okta automatically sends the authN request to the Identity Provider Single Sign-On URL.

   • IdP Signature Certificate — Click Browse files to upload the certificate from the Identity Provider used to sign the assertion.

   Note: For more information about Advanced Settings, see Social Identity Provider Settings.

4. Click Add Identity Provider. The Identity Providers page appears.

5. Locate the Identity Provider that you just added and click the arrow next to the Identity Provider name to expand.

   • Apple
   • Azure AD
   • Facebook
   • Google
   • LinkedIn
   • Microsoft
   • Okta-to-Okta
   • OpenID Connect
   • SAML 2.0

   • Save the value at the end of the Assertion Consumer Service URL (ACS URL). The string after the last slash is the Identity Provider's id value. For example, if your ACS URL is https://${yourOktaDomain}/sso/saml2/0adb8rlfooi5Atqv60h7, then your Okta Identity Provider's id is 0adb8rlfooi5Atqv60h7.

   • Save the Audience URI value.

   • Download the metadata by clicking Download metadata. The metadata URL is similar to this: https://${yourOktaDomain}/api/v1/idps/{IdP_ID}/metadata.xml.

   Upload the metadata

   Follow the SAML IdP instructions on how to upload the metadata. If your IdP doesn't support uploading metadata, enter the ACS URL and Audience URI values at the IdP manually.

Attribute Mapping

When a user first signs in to Okta using an OpenID Connect Identity Provider, their Identity Provider user profile is mapped to an Okta Universal Directory profile using Just-In-Time provisioning. This user account creation and linking includes default mappings that are based on standard claims defined by the OpenID Connect specification.

To view and modify the mappings, access the Identity Provider that you created by selecting Social & Identity Providers from the Users menu. Click Configure for the Identity Provider and select Edit Mappings.

If there are attributes that don't exist in your org's Universal Directory, but are a part of the user's Identity Provider profile, add the attributes by editing the Identity Provider user profile in your org.

See Manage User Profiles for more information on custom attributes.

Next: Register an App in Okta