> ## Documentation Index
> Fetch the complete documentation index at: https://docs.subframe.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Okta SSO

> Configure Okta single sign-on for your Subframe team.

<Info>
  This feature is only available on the Custom Plan. If you are an existing Custom Plan customer, continue with the
  setup below. Once completed, contact us to enable SSO for your team.
</Info>

<Steps>
  <Step title="Create App Integration in the Applications dashboard">
    Navigate to the Applications dashboard of the Okta admin console. Click *Create App Integration*.

    <img src="https://mintcdn.com/subframe-59800133/UtzN_VZHB2fC7oGB/images/sso/okta/step-1.png?fit=max&auto=format&n=UtzN_VZHB2fC7oGB&q=85&s=a047f231197a81e9e11fd7941de3b631" alt="Okta Applications dashboard with Create App Integration button" width="3456" height="996" data-path="images/sso/okta/step-1.png" />
  </Step>

  <Step title="Choose SAML 2.0 in the App Integration Dialog">
    Subframe supports the SAML 2.0 SSO protocol. Choose it from the *Create a new app integration* dialog.

    <img src="https://mintcdn.com/subframe-59800133/UtzN_VZHB2fC7oGB/images/sso/okta/step-2.png?fit=max&auto=format&n=UtzN_VZHB2fC7oGB&q=85&s=f9b4485c1d9f776a37e3fdf1ca47abd6" alt="Create a new app integration dialog with SAML 2.0 selected" width="3452" height="1558" data-path="images/sso/okta/step-2.png" />
  </Step>

  <Step title="Fill out general settings">
    The information you enter here will be shown in your Okta applications menu. The App name should typically be **Subframe**.

    <img src="https://mintcdn.com/subframe-59800133/UtzN_VZHB2fC7oGB/images/sso/okta/step-3.png?fit=max&auto=format&n=UtzN_VZHB2fC7oGB&q=85&s=5c03255e2bce68ca53f9f0cce2ad27b8" alt="General settings form with App name field" width="3456" height="1328" data-path="images/sso/okta/step-3.png" />

    You can download the Subframe logo to upload as the **App logo** below:

    <img src="https://mintcdn.com/subframe-59800133/UtzN_VZHB2fC7oGB/images/sso/okta/logo.png?fit=max&auto=format&n=UtzN_VZHB2fC7oGB&q=85&s=035b12ffa65b6b28927ca0b986b52316" alt="Subframe logo for Okta app" width="244" height="244" data-path="images/sso/okta/logo.png" />
  </Step>

  <Step title="Fill out SAML settings">
    These settings let Subframe use SAML 2.0 properly with your Okta application. Make sure you enter this information exactly as shown in this table and screenshot.

    | Setting                                        | Value                                                |
    | ---------------------------------------------- | ---------------------------------------------------- |
    | Single sign-on URL                             | `https://api.subframe.com/auth/v1/sso/saml/acs`      |
    | Use this for Recipient URL and Destination URL | ✔️                                                   |
    | Audience URI (SP Entity ID)                    | `https://api.subframe.com/auth/v1/sso/saml/metadata` |
    | Default `RelayState`                           | `https://app.subframe.com`                           |
    | Name ID format                                 | `EmailAddress`                                       |
    | Application username                           | Email                                                |
    | Update applicate username on                   | Create and update                                    |

    <img src="https://mintcdn.com/subframe-59800133/UtzN_VZHB2fC7oGB/images/sso/okta/step-4.png?fit=max&auto=format&n=UtzN_VZHB2fC7oGB&q=85&s=55b304692b07fd855593083a3748741f" alt="SAML settings form with Single sign-on URL and Audience URI fields" width="3456" height="1704" data-path="images/sso/okta/step-4.png" />
  </Step>

  <Step title="Fill out attribute settings">
    Attribute Statements allow Subframe to get information about your Okta users on each login.

    A `email` to `user.email` **statement is required**. Other mappings shown below are optional and configurable depending on your Okta setup. If in doubt, replicate the same config in the screenshot below.

    <img src="https://mintcdn.com/subframe-59800133/UtzN_VZHB2fC7oGB/images/sso/okta/step-5.png?fit=max&auto=format&n=UtzN_VZHB2fC7oGB&q=85&s=ab4b51667643fe6804e0e223889e34c7" alt="Attribute Statements configuration with email mapping" width="3456" height="1474" data-path="images/sso/okta/step-5.png" />
  </Step>

  <Step title="Obtain IdP metadata URL">
    Subframe needs to finalize enabling single sign-on with your Okta application.

    After you finalize the creation of your Subframe Application in Okta copy the Metadata URL and send it to your Subframe contact. If you're not sure who to send this to or need further assistance, contact [support@subframe.com](mailto:support@subframe.com).

    The Metadata URL usually has this structure: `https://<okta-org>.okta.com/apps/<app-id>/sso/saml/metadata`

    <img src="https://mintcdn.com/subframe-59800133/UtzN_VZHB2fC7oGB/images/sso/okta/step-6.png?fit=max&auto=format&n=UtzN_VZHB2fC7oGB&q=85&s=ab76cfe559bbedcfbda3f1af6642c50d" alt="Sign On settings page showing Metadata URL location" width="3456" height="1808" data-path="images/sso/okta/step-6.png" />
  </Step>

  <Step title="Wait for confirmation">
    Once you’ve configured the Okta app as describe above, send the Metadata URL to your support contact at Subframe.

    Wait for confirmation that this information has successfully been added to Subframe. It usually takes us less than 1 business day to configure this for your team.
  </Step>

  <Step title="Test single sign-on">
    Once you’ve received confirmation from your support contact at Subframe that SSO setup has been completed, you can ask some of your users to sign in with SSO via their Okta account.

    All they need to do is enter their work email address when they choose to sign in with SSO.

    If sign in is not working correctly, reach out to your support contact at Subframe for further guidance.
  </Step>
</Steps>