Set up single sign-on with Okta | Axiamatic Help Center

Let your team sign in to Axiamatic with their Okta accounts.

Overview

Single sign-on (SSO) with Okta is a connection that lets people in your organization sign in to Axiamatic with the Okta account they already use. The connection uses SAML 2.0, a standard way for Okta to tell Axiamatic who a person is.

Setup runs in both directions. Axiamatic sends you the details you need to create the app in Okta. You then send back two files that let Axiamatic trust sign-ins from your organization.

Before you start

Axiamatic emails you three things before setup. Keep the email open, because you paste two of these values into Okta.

ACS URL: the Assertion Consumer Service URL, which is where Okta sends people after they sign in. You paste it into Single sign on URL.
Entity ID: the name that identifies Axiamatic as a SAML app. You paste it into Audience URI (SP Entity ID).
Axiamatic logo: an image file you upload as the app logo.

You also need an Okta admin role that can create app integrations and assign users to them.

Create the Axiamatic app in Okta

To create the app, sign in to Okta as an admin and follow these steps.

Go to Applications > Applications and click Create App Integration.
Select SAML 2.0 and click Next.
On the General Settings page, enter Axiamatic as the App name.
Upload the Axiamatic logo from the email as the App logo so your team recognizes the app in their Okta dashboard.
Click Next to open the Configure SAML page.

Configure SAML settings

The SAML settings tell Okta where to send people after they sign in and which details to pass to Axiamatic. Fill them in on the Configure SAML page.

In the General section, paste the ACS URL from Axiamatic into Single sign on URL. Keep Use this for Recipient URL and Destination URL checked.
Paste the entity ID into Audience URI (SP Entity ID).
Set Name ID format to EmailAddress.
In Attribute Statements, enter email as the Name, choose Basic as the Name format and select user.email as the Value.
Click Add Another and enter name with Basic and user.firstName. These two attributes send each person's email and name to Axiamatic.
Click Next.
On the Feedback page, choose the option that describes your organization and click Finish.

Okta creates the app and opens it.

Send your IdP metadata and certificate to Axiamatic

Axiamatic needs two files from Okta to trust sign-ins from your organization. To get them, open the Axiamatic app in Okta and follow these steps.

Go to the Sign On tab.
In SAML Signing Certificates, check that the SHA-2 certificate shows Active.
Click Actions next to the SHA-2 certificate and select View IdP metadata.
Save the page that opens as an XML file.
Click Actions again and select Download certificate.
Send both files to your Axiamatic contact by replying to the setup email.

SSO starts working once Axiamatic adds these files on its side and confirms with you.

Assign users and groups

Okta only lets people sign in to Axiamatic if they are assigned to the app. To assign them, open the Axiamatic app in Okta and follow these steps.

Go to the Assignments tab.
Click Assign and choose Assign to People or Assign to Groups.
Click Assign next to each person or group, then click Done.

Axiamatic recommends assigning groups instead of individual people. New teammates then get access as soon as they join the group, and nobody has to update the app by hand.

FAQ

Where do I find the ACS URL and entity ID?

Axiamatic sends them in the setup email along with the logo. Contact your Axiamatic representative if you don't have the email.

Okta shows a security risk warning about the certificate. What should I do?

Okta shows this warning when the active certificate covers your whole Okta org instead of one app. If you generate a new app-specific certificate as Okta suggests, make it active before you download the metadata and certificate. Axiamatic needs the files for the certificate that signs sign-ins.

A teammate can't sign in. What should I check?

Check that the teammate, or a group they belong to, is assigned to the Axiamatic app in Okta. Unassigned people can't sign in through SSO.

What happens if I replace the signing certificate later?

Sign-ins stop working until Axiamatic has the new certificate. Send the new metadata and certificate to Axiamatic before you make the new certificate active.

For pricing information, demo requests, or assistance, contact us at [email protected]

Set up single sign-on with Azure AD