> For the complete documentation index, see [llms.txt](https://docs.1kosmos.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.1kosmos.com/integrations/authentication/external-identity-provider-sso-federation/1kosmos-as-an-external-identity-provider-in-okta.md). # 1Kosmos as an External Identity Provider in Okta > **Roles in this integration** > > * **Identity Provider (IdP):** 1Kosmos > * **Service Provider (SP):** Okta > * **Protocol:** SAML ### Configuring SAML To configure SAML, complete the following tasks. #### Add a SAML Identity Provider 1. In the Okta Admin Console, navigate to **Security > Identity Providers**. 2. Click **Add identity provider**, then select **SAML 2.0 IdP**. 3. Click **Next**. 4. Configure the **General Settings**: | Field | Description | | ----- | ------------------------- | | Name | Enter a name for the IdP. | 5. Configure the **Authentication Settings**: | Field | Description | | ---------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | IdP Usage | Select an authentication method: **SSO only** for single sign-on, or **Factor only** for multi-factor authentication. | | Account matching with Persistent Name ID | Select **Use Persistent Name ID (Higher Security)** to determine the associated user account by matching the Name ID with the External ID. If no match is found, Okta uses the **IdP username** value for account matching. | 6. Configure the **Account matching with IdP Username** options: | Field | Description | | ----------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | IdP username | Select the entity in the SAML assertion that contains the username. | | Filter | Select **Only allow usernames that match defined RegEx Pattern** to enter an expression as a username filter. | | Match against | Select the user attribute to match against the IdP username. | | Account link policy | Select **Enable automatic linking** to automatically link the user's IdP account with a matching Okta account. | | IdP Issuer URI | Enter the issuer URI from the IdP. | | IdP Single Sign-On URL | Enter the sign-on URL from the IdP. | | IdP Signature Certificate | Upload the certificate from the IdP used to sign the assertion. Click **Browse files**, select the file, then click **Open**. | | Request Binding | Select the SAML Authentication Request Protocol binding Okta uses to send SAML authorization request messages to the IdP. | | Request Signature | Select **Sign SAML Authentication Requests** to sign the request messages sent by Okta. If selected, Okta automatically sends the authorization request to the URL specified in the IdP Single Sign-On URL field. | | Response Signature Verification | Select the type of response signatures Okta accepts when validating incoming responses: **Response**, **Assertion**, or **Response or Assertion**. | | Response Signature Algorithm | Select the signature algorithm Okta uses to validate SAML messages and assertions from the IdP: **SHA-1** or **SHA-256**. | | Destination | Enter the destination attribute Okta includes in the SAML authorization request. | | Okta Assertion Consumer Service URL | Specify whether to use a trust-specific assertion consumer service (ACS) URL or one shared across the organization: **Trust-specific** or **Organization (shared)**. | | Max Clock Skew | Specify how long the assertion remains valid. | 7. Click **Finish**. After creating the IdP, click **Download metadata** to access the Okta SAML metadata for the 1Kosmos provider. #### Configure Identity Provider routing rules You can configure routing rules for each identity provider or for different combinations of user criteria. 1. In the Okta Admin Console, navigate to **Security > Identity Providers**. 2. On the **Routing Rules** tab, click **Add Routing Rule**. 3. Enter a **Rule Name**. 4. Configure the routing conditions: | Field | Description | | ------------------------------- | --------------------------------------------------------- | | IF User's IP is | Select a network zone. | | AND User's device platform is | Select the device that can be used for configuring rules. | | AND User is accessing | Select the type of application the user should access. | | AND user matches | Select the login attributes the user should match. | | THEN Use this Identity provider | Select the IdP to use when all conditions are met. | 5. Click **Create rule** and indicate whether you want to activate the rule immediately. 6. To activate the rule, click **Activate**. ### Configuring applications on 1Kosmos You can configure Okta applications with 1Kosmos using either of the following methods. #### Using SAML 2.0 Generic 1. Log in to the 1Kosmos tenant as a community administrator. 2. Navigate to **Applications > Add Applications**. 3. In the **Saml 2.0 Generic** tile, click **Add Integration**. 4. On the wizard page, click **Add Application**. 5. In **Basic Settings**, specify the application name, its URL, and the instance to which the configuration applies, then click **Next**. 6. In **SAML Settings**, go to the **Assertion Statement (NameID)** section, select the format of the NameID and its value, then click **Next**. 7. In **Advanced Options**, specify the entity ID and the Assertion Consumer Service (ACS) details, then click **Save**. #### Using the Okta integration (prebuilt) 1. Log in to the 1Kosmos tenant as a community administrator. 2. Navigate to **Applications > Add Applications**. 3. In the **Pre-built integrations** section, click **Add integration** under the **Okta** tile. 4. On the Okta page, enter the application name, service provider name, and the Okta API token, then click **Connect**. The added application appears on the **Manage applications** home page. {% hint style="info" %} **Note:** You can use the **Okta API** token link under the **Before we begin** section on the Okta page to generate a token. {% endhint %} ### Testing the integration 1. Open the application URL. 2. You are redirected to the 1Kosmos Login page. 3. Use the 1Kosmos app to scan the QR code. You are redirected to the landing page of the Okta application. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.1kosmos.com/integrations/authentication/external-identity-provider-sso-federation/1kosmos-as-an-external-identity-provider-in-okta.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.