# SAML with Okta

{% hint style="info" %}
This process can only be fully achieved in collaboration with our team. 

Exact instructions are provided in the impacted sections below where this exchange of information is required.
{% endhint %}

## Create a new SAML application in the Okta Admin Console

1. Sign-in to your Okta Admin Console.
2. On the sidebar, navigate to **Applications** -> **Applications**
3. On the main view, click "Create App Integration" button

<figure><img src="https://1179008450-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F1eBCWu9rFSzq3ahnNrmL%2Fuploads%2FKmZimv1AClQiiQBEtyLS%2Fimage.png?alt=media&#x26;token=999393e9-37c5-4dac-9f0b-43129b05b32b" alt=""><figcaption><p>Create SAML Application</p></figcaption></figure>

4. In the Modal Dialog, select **SAML 2.0** and click **Next**

<figure><img src="https://1179008450-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F1eBCWu9rFSzq3ahnNrmL%2Fuploads%2FHCIeviBGDYWZxgsxf8QA%2Fimage.png?alt=media&#x26;token=af5f1b27-f7e1-4c70-93dc-0e7f6a5dfad1" alt=""><figcaption><p>Select App Integration type</p></figcaption></figure>

## Configure SAML Application&#x20;

### Under the General Settings tab

1. Choose a name of the connection (that name will appear on your Okta apps)
2. Add application logo (optional)&#x20;
3. Click **Next**

### Under the Configure SAML tab

1. **Single sign-on URL** set [https://auth.rely.io/login/callback/login/callback?connection={CONNECTION\_NAME}](https://auth.rely.io/login/callback/login/callback?connection=okta-saml-prod-viktor)

{% hint style="info" %}
Note

We will provide you with a {CONNECTION\_NAME}. To get it, use one of our dedicated channels:

* Direct outreach to your dedicated Customer Success Manager
* In Slack via your Dedicated Channel (for Enterprise customers)
* Via your in-product chatbot
* Via email to <support@rely.io>
  {% endhint %}

2. **Audience URI (SP Entity ID)** set  `urn:auth0:relyio:{CONNECTION_NAME}`
3. Scroll down to the **Attribute Statements** section:&#x20;
   1. Add an attribute statement for [`https://app.rely.io/email`](https://app.rely.io/email) with **Value** set to `user.email`
4. Click **Next** and then **Finish** to create the application.

<figure><img src="https://1179008450-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F1eBCWu9rFSzq3ahnNrmL%2Fuploads%2F8VoJjGIfMVuCCHYOqLBo%2Fimage.png?alt=media&#x26;token=cecc4822-20dc-4784-8d30-59733752f80b" alt=""><figcaption><p>Set SSO Url and Audience</p></figcaption></figure>

### Share the Sign on URL and X509 Certificate with Rely.io

To secure the SAML connection, share a certificate with Rely and the Sign-in URL

{% hint style="info" %}
You can share the data using one of our dedicated channels:

* Direct outreach to your dedicated Customer Success Manager
* In Slack via your Dedicated Channel (for Enterprise customers)
* Via your in-product chatbot
* Via email to <support@rely.io>
  {% endhint %}

#### Share the Sign on URL with Rely.io

1. Navigate to the previously created SAML application
2. Select the **Sign On** tab
3. On **Metadata details,** click **More details** to expand the Sign-on URL
4. Copy the **Sign-on URL** and share it with Rely

<figure><img src="https://1179008450-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F1eBCWu9rFSzq3ahnNrmL%2Fuploads%2FVxe5iWbC3Ur2PBUSjzWp%2Fimage.png?alt=media&#x26;token=5c4ed38d-2ec8-41c8-8ef5-f7a03e5540fb" alt=""><figcaption><p>Copy Single Sign-On url</p></figcaption></figure>

### Share X509 Certificate with Rely

1. Scroll down to find the **SAML Signing Certificates** section.
2. Generate a new certificate via the **Generate new certificate** button
3. Find the **Active** certificate and click **Actions**
4. Click **Download certificate**
5. Share the certificate with Rely

<figure><img src="https://1179008450-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F1eBCWu9rFSzq3ahnNrmL%2Fuploads%2FJkYKDJ0FOCKZToIB0cRd%2Fimage.png?alt=media&#x26;token=e9a1fe03-6b04-4ac8-a678-0f94c7778cb2" alt=""><figcaption><p>Generate and download certificate</p></figcaption></figure>

There you go! You can now use Single Sign-on with Okta and Rely.io.

## Sync Okta Groups with Rely (Optional)

You can expose Okta groups with the Rely app. This will allow your Rely users to have their Okta groups in sync with Rely teams. Follow the steps below to expose Okta groups:&#x20;

1. In the Okta Admin Console, navigate to **Applications** and select the newly created SAML application.
2. Select the **General** tab
3. Scroll down to **SAML Settings -> Edit**
4. At the **Configure SAML** tab, scroll down to **Group Attribute Statements (optional)**
5. Add **groups** as names, and **filter: Matches regex: `.*`**
6. Save

<figure><img src="https://1179008450-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F1eBCWu9rFSzq3ahnNrmL%2Fuploads%2F4VCwMa9RtxaYDZQCNPtp%2Fimage.png?alt=media&#x26;token=67da59a7-96d4-4daf-a0c3-2563cf9d56a2" alt=""><figcaption></figcaption></figure>

When your users log in to Rely using this SAML connection, the user's groups will be imported into Rely as teams out of the box, allowing your users to communicate, share resources and manage tasks efficiently within a group.