# Single Sign-On SAML Integration - Okta

If you have an Enterprise account in Row Zero, you can configure single sign-on (SSO) via [SAML 2.0](https://wiki.oasis-open.org/security/FrontPage#SAML_V2.0_Standard) using your organization's existing Okta SSO provider. Row Zero supports SAML 2.0 for single sign-on with HTTP-POST binding.

Here is the information that you will need to configure a new Row Zero SAML application in Okta:

1. In the Okta "Admin Console", navigate to "Applications --> Applications"  

   ![scim okta applications](https://cdn.sanity.io/images/2w8agf2t/production/7aed2a477b9667071b5c1b3e0993c9872a85a724-287x512.png)

2. Click on the "Create App Integration" button:  

   ![scim okta app integration](https://cdn.sanity.io/images/2w8agf2t/production/541f5e2b7490f2857eb0c9e5503db783f513e73f-286x72.png)

3. Select "`SAML 2.0`" and click the "Next" button:  

   ![scim okta app integration saml](https://cdn.sanity.io/images/2w8agf2t/production/780aad7eb48e70dcf72986e480626a666c7a5fcd-1392x795.png)

4. In the "Create SAML Integration" page, provide the following:
    - For the "**App name**" type "`Row Zero`"
    - Find Upload new logo. You can click [this link](https://d3gu6cpxmtctuo.cloudfront.net/brand/v2/rz-logo-black.png) to download the Row Zero logo, and then upload for "**App logo**"
    - Leave the "**Do not display application icon to users**" _**unchecked**_
    - Click the "Next" button  

      ![scim okta saml settings](https://cdn.sanity.io/images/2w8agf2t/production/f0fc78bdce01de19f2d52cac22e4ee3c6ea045df-1547x853.png)

5. For the "SAML Settings" - "General" page, provide the following:
    - Leave the "**Use this for Recipient URL and Destination URL**" _**checked**_
    - For "**Single sign-on URL**" type "`https://auth.rowzero.io/login/callback?connection=<CONNECTION_NAME>`"
        - **Note:** You will need to replace `CONNECTION_NAME` above with an identifier that Row Zero will provide. Contact us when you are setting up your SSO integration and we will give you the `CONNECTION_NAME` to use.
    - For "**Audience URI (SP Entity ID)**" type "`urn:auth0:rowzero:<CONNECTION_NAME>`"
        - **Note:** Again, replace `CONNECTION_NAME` with the identifier Row Zero provides.
    - For **Default RelayState**" type "`https://rowzero.com/startlogin?connection=<CONNECTION_NAME>`"
        - **Note:** Again, replace `CONNECTION_NAME` with the identifier Row Zero provides.
    - For "**Name ID format**" provide "`EmailAddresses`"
    - For "**Application username**" provide "`Email`"
    - For "**Update application username on**" provide "`Create and Update`"
    - Under _**Attribute Statement (Optional)**_
        - For "**Name**" type "`email`"
        - For "**Name format**" provide "`Unspecified`"
        - For "**Value**" select "`user.email`"
        - Click the "**Add Another**" button
        - For "**Name**" type "`name`"
        - For "**Name format**" provide "`Unspecified`"
        - For "**Value**" type "`user.displayName`"
        - Click the "**Add Another**" button
        - For "**Name**" type "`email_verified`"
        - For "**Name format**" provide "`Unspecified`"
        - For "**Value**" type "`true`"
    - Click the "Next" button  

      ![scim okta saml general settings](https://cdn.sanity.io/images/2w8agf2t/production/9c43516eb4b84ed210c6d0132eddebf495b9bb23-1555x1686.png)

6. Click the "Finish" button:  

   ![scim okta create saml integration](https://cdn.sanity.io/images/2w8agf2t/production/78169851f2b92fa4786f096e03a554c8b069c09d-1102x1073.png)

7. In the "Row Zero" app, under the "Assignments" tab, click on the "Assign" button and select the appropriate users ("Assign to People") and groups ("Assign to Groups"):  

![scim okta saml sso assignments](https://cdn.sanity.io/images/2w8agf2t/production/557d7bf57350d93df9faf97156346ca1c56e4199-1137x1066.png)

Once you have configured a Row Zero SAML application in Okta, contact us at Row Zero so that we can finish configuring the SSO integration on our end.

This is the information that we will need from you:

1. The "**Sign on URL**" from the SAML application and the "**Signing Certificate**" from Okta. **Do not share this via email or other unsecured means.** We will give you a secure way to provide your certificate.  

   ![scim okta row zero information](https://cdn.sanity.io/images/2w8agf2t/production/22b7849a7b2267516e0599658ee9e4544604d484-1591x1695.png)

2. Your identity provider domain(s) for login experience (e.g., `yourcompany.com`)