Skip to main content
Connect your Okta org to Enclave so your workforce signs in with Okta. Enclave supports both SAML 2.0 and OIDC with Okta — pick one. See the Authentication overview for how SSO fits with the rest of Enclave.
Where: Organization → Single Sign-On in Enclave. Only the Owner role can manage SSO connections. One email domain maps to one connection.

​
Before you start

  1. You need Owner access in Enclave and admin access in Okta.
  2. Decide SAML or OIDC — both work. OIDC is a little simpler (no SP certificate); SAML is the traditional enterprise choice. The rest of this page has a section for each.
  3. Have your email domain ready (e.g. acme.com) — you’ll verify ownership of it.
1

Create an OIDC app in Okta

Okta Admin → Applications → Create App Integration → OIDC - OpenID Connect → Web Application.
  • Sign-in redirect URI: https://<your-enclave-host>/api/auth/oidc/callback
  • Grant type: Authorization Code
  • Assign the app to the users/groups who should have access.
Copy the Client ID and Client Secret.
2

Add the connection in Enclave

Organization → Single Sign-On → Add Connection → OIDC:Enclave discovers the endpoints automatically. The client secret is encrypted at rest with your KMS.
3

Verify your domain, then enable

Complete domain verification below, toggle the connection Enabled, and sign in with an email on the domain.

​
Option B — SAML 2.0

Okta’s “View SAML setup instructions” screen gives you several values — the trick is knowing which goes where. A URL is not always an ID.
1

Create a SAML app in Okta

Okta Admin → Applications → Create App Integration → SAML 2.0. On the Configure SAML step:Under Attribute Statements, map at least email (first/last name are picked up automatically). Finish the wizard.
2

Set signing options (must match)

In the app’s SAML Settings → Show Advanced Settings, confirm:
  • Response or Assertion Signature → Signed (assertion-signed is fine)
  • Signature Algorithm → RSA-SHA256
  • Digest Algorithm → SHA256
  • Assertion Encryption → Unencrypted (Enclave does not support encrypted assertions)
3

Add the connection in Enclave — map the fields carefully

Organization → Single Sign-On → Add Connection → SAML. Get the IdP values from Okta’s app Sign On → View SAML setup instructions:
The IdP Entity ID / Issuer is Okta’s Identity Provider Issuer (http://www.okta.com/exk15me6794se8pM1698) — not the Okta metadata URL (…/sso/saml/metadata). If you paste the metadata URL here, sign-in fails with “assertion validation failed” (idp_issuer_mismatch). Tip: open the metadata URL in a browser and copy the entityID="…" value — that is the Issuer.
4

Provision the SP signing certificate

Enclave signs SAML requests with its own Service Provider certificate. On the connection card, under SP signing certificate, click Generate (self-signed) — no OpenSSL needed. (You can also Use internal CA or Upload your own.) The private key is encrypted at rest with your KMS.
5

Set Okta's Audience to the per-connection metadata URL

On the connection card, copy the SP Entity ID / Audience URI (it equals the per-connection metadata URL, …/api/auth/saml/metadata/<connection-id>) and paste it into Okta’s Audience URI (SP Entity ID) field.
Okta’s Audience is Enclave’s per-connection metadata URL (with the connection id) — not the bare /api/auth/saml/metadata. A mismatch fails with audience_mismatch.
6

Verify your domain, then enable and test

Complete domain verification, toggle Enabled, and sign in with an email on the domain.

​
Verify your domain

Before a connection can sign anyone in, prove you control its email domain (prevents domain squatting across tenants).
1

Copy the TXT record

The connection card shows a DNS TXT record like enclave-verification=<token>.
2

Publish it and verify

Add it at your domain’s apex (e.g. acme.com) in your DNS provider, then click Verify. DNS can take a few minutes to propagate.
A connection will not route or complete any sign-in until its domain is verified — even if toggled on.

​
After it works — per-connection policies

On the connection card you can tune, at any time:
  • Who can sign in (provisioning mode): Invited users only (default — unknown Okta identities are rejected) or Anyone in the directory (auto-provision).
  • Require fresh sign-in at IdP: force Okta to re-authenticate on every login.
  • Single Logout (SLO): also end the Okta session when the user signs out of Enclave (turn on Okta’s SLO too).
See Authentication for the full behavior of each.

​
Troubleshooting

The ACS response and server logs name the exact cause. Common reason values: If you still see “invalid or expired SSO session”, start the login from Enclave’s sign-in page (not the Okta app tile) — Enclave is SP-initiated only.