Skip to main content

Set Up Single Sign-On (SSO) with Okta

Use this guide to configure Single Sign-On (SSO) using Okta as your Identity Provider (IdP) for secure login to Knak.

Before You Begin

  • Only users with the SSO configure permission can open the SSO setup page in Knak.

  • You need admin access to your company’s Okta account.

  • Setup happens in two places: Knak and Okta. Keep both open in separate browser tabs. You will copy values back and forth.

Demo Video

Part 1: Copy Your Details from Knak

  1. Go to Admin > Settings > Login.

  2. Click Configure next to Single Sign-On (SSO).

    Login Settings UI

  3. Copy the Single Sign-On URL and the Audience URI. You will paste them into Okta in Part 2.

    IdP fields to update your SSO connection.

Single Sign-On URL

  • Okta uses this URL to send login details to Knak. These login details are called a SAML assertion.

Audience URI

  • This tells Okta that Knak is the app receiving the login details.

  • It makes sure login attempts are valid for your organization.

Part 2: Set Up the SAML Application in Okta

Step 1: Create the Application

  1. In Okta, create a new SAML 2.0 application.

    New App creation UI in Okta.

  2. Name the application (for example, “Knak”).

    Create SAML Integration UI in Okta.

Step 2: Configure SAML Settings

  1. Go to the SAML Settings section.

  2. Paste the Single Sign-On URL and Audience URI you copied from Knak.

  3. Set the Application username format to Email.

  4. Leave the other settings as they are, unless your IT team tells you otherwise.

    SAML settings page in Okta with arrow pointing to "Application Username > Email"

Step 3: Get the IdP SSO URL and Certificate

  1. Go to the app’s Sign On tab.

  2. Click View SAML setup instructions.

    SAML Setup Instructions page.

  3. Copy the IdP SSO URL.

  4. Download the x509 Certificate.

    IdP SSO URL link and x509 Certificate file location.

Part 3: Finish Setup in Knak

  1. Go back to the SSO setup page in Knak.

  2. Paste the IdP SSO URL from Okta into the Identity Provider Single Sign-On URL field.

  3. Upload the x509 Certificate from Okta into the x509 Public Key Certificate field.

    Required fields for Knak for SSO configuration.

  4. Click Save. When it works, you will see the message Created new SAML connection for SSO! in the top right corner.

Identity Provider Single Sign-On URL (IdP SSO URL)

  • This is where Knak sends users to log in.

  • The URL must start with http:// or https://.

x509 Public Key Certificate

  • This file lets Knak confirm that login details really come from your Okta account.

  • Knak accepts .cer, .cert, .crt, and .pem files.

Turn SSO On or Off

After you save your connection, the Enable SSO for your company toggle appears at the top of the SSO setup page.

  • A new connection is turned on when you save it.

  • Use this toggle to turn SSO on or off for your company.

    The SSO setup page with the Enable SSO for your company toggle highlighted

Update Your Certificate Before It Expires

Okta certificates expire. If your certificate expires, your users will not be able to log in with SSO.

After setup, the SSO page shows when your certificate expires. Look for the line Public certificate currently tied to this SAML connection expires on [date].

Before that date:

  1. Download the new x509 certificate from the Sign On tab of your Knak app in Okta.

  2. Go to Admin > Settings > Login in Knak.

  3. Click Configure next to Single Sign-On (SSO).

  4. Click Browse in the x509 Public Key Certificate field.

    Browse button highlighted in the x509 Certificate field.

  5. Select the new certificate file you downloaded from Okta.

  6. Click Update. When it works, you will see the message Updated SAML connection for SSO!

Tip: Add a calendar reminder a few weeks before the expiry date.

Common Error Messages and How to Fix Them

You may see one of these messages when you save or update your SSO connection in Knak. Find the message below and follow the steps to fix it.

Error message

How to fix it

You must specify an Identity Provider Single Sign On URL

Paste the IdP SSO URL from Okta into the Identity Provider Single Sign-On URL field.

The Identity Provider Single Sign On URL is invalid

Check that the URL starts with http:// or https://.

You must upload a public key certificate

Click Browse and upload the x509 certificate you downloaded from Okta.

File does not have proper extension

Upload a .cer, .cert, .crt, or .pem file.

Important Notes and Limitations

  • Users can log in two ways. They can start from the Knak login page. They can also start from their Okta dashboard. Starting from Okta is called IdP-initiated login.

  • Users must be added to Knak manually. Okta cannot provision users automatically via IdP alone.

  • Knak supports System for Cross-domain Identity Management (SCIM). SCIM creates and updates users in Knak for you. Follow this guide to set up SCIM with Okta.

  • You can choose whether users must log in with SSO, or can also use a password. Go to Admin > Settings > Login:

    • Turn on Username and Password Login to let users log in with a username and password.

    • Turn it off to force users to log in with SSO.

    Username and Password Login feature toggle.

Additional Resources

For general information on SAML and Okta setup, visit Okta’s SAML documentation.

Need more help? Contact support via live chat within Knak using the chat bubble in the bottom right corner or email support@knak.com.

Related Articles
Did this answer your question?