> ## Knowledge Base Index
> Fetch the complete knowledge base index at: https://help.metalocator.com/sitemap.xml
> Use this file to discover available pages before exploring further.
> Pure-Markdown content can be obtained by appending a '.md' suffix to the content URLs listed in the sitemap (without the trailing slash).

# Configuring Single Sign On with OKTA

This article describes setting up single sign-on (SSO) with [Okta](http://okta.com). This feature must be enabled in your account by a MetaLocator support technician in order to function as shown in this article.

## Step 1. Configure the Account

Login as the Account Owner and go to **My User Profile**

[![](https://storage.crisp.chat/users/helpdesk/website/-/a/e/1/b/ae1bafd4a32e3000/3a03addd-466b-451c-8b66-57b61c_1cwsxkg.png)](https://downloads.intercomcdn.com/i/o/234495469/1efc485c8fb71864244f77f6/image.png?expires=1794512700&signature=393ec90e87fdfa6a294887007a8fd7b72c41d67ca33529c937632b0736d09612&req=diMjEsB7mYdWFb4f3HP0gGl1RQogTsVucKtyN5Ox1oCvcMeJXGoqGT2Le%2FkF%0AdDzATKbZcv0TtQqV3w%3D%3D%0A)

Select the SSO tab, then update the following options according to your Okta settings.

[![](https://storage.crisp.chat/users/helpdesk/website/-/7/e/d/e/7ede9c8ff2480400/82bc59a6-eb69-41cf-b004-6c3d19_1ax1vt0.png)](https://downloads.intercomcdn.com/i/o/yn1vvwtq/2675006182/63ebf1812ec6ab101e144484e3f1/image.png?expires=1794512700&signature=d7b3da177a0347c4de922994e6729b2e99eb26890e540855f7c5eb3e5dd4f4ad&req=diYgE8l%2Bm4BXW%2FMW1HO4zQ6b9tAGM4uhJhtW6hB%2FiSNKiP0aW93pEC%2BGhmLr%0AsUY%2Flbnan0wL3L1Y3gU%3D%0A)

Set the SSO Domain to the domain associated with your email address, e.g. customer.com. This ensures that the anonymous link on our login form knows which SSO to invoke based on an incoming email.

[![](https://storage.crisp.chat/users/helpdesk/website/-/d/8/f/9/d8f91f393eab4800/8975efe9-ec98-4a99-96e3-8891a5_8sogoz.png)](https://downloads.intercomcdn.com/i/o/379685772/411f6d43ea695d44a4596d7a/image.png?expires=1794512700&signature=37c299057d25695737b73b032a0d905dfdea9d48078a5d24c96034344489b777&req=dycuEMF7moZdFb4f3HP0gLp%2B%2B85OJNFNEOmimFdDvBHDivm2wcustJxsWngt%0AhEX3j2HlNUzT1lzN5Q%3D%3D%0A)

Within Okta, create a new App called "MetaLocator", with the following SSO URL. This is also known as the ACS URL.  
​  
​[https://admin.metalocator.com/plugins/user/oneloginsaml/oneloginsaml.php?acs=&id=XXXXX](https://admin.metalocator.com/plugins/user/oneloginsaml/oneloginsaml.php?acs=&id=XXXXX)  
​  
Where XXXXX is your primary account owner's User ID as shown below:

[![](https://storage.crisp.chat/users/helpdesk/website/-/3/1/9/d/319da1cd80129800/3ae3b427-aebb-467c-8b47-841762_157mq6i.png)](https://downloads.intercomcdn.com/i/o/320794902/ccf7172a854457184cb88ac2/image.png?expires=1794512700&signature=20455589185f3acdefc1836ba43b44f7d9c5de8ba071f3796a3e8ffaa74593db&req=dyInEcB6lIFdFb4f3HP0gBY1eYFhdmasJDTCygdQjKOBYbP9byPoH0u4LM4D%0AWnoscWNKjpOxlgBN0Q%3D%3D%0A)

Service Provider Entity ID should be

**metalocator-saml**

Users will be created on the fly based on the email address coming from Okta. The accounts will be created as "blocked" accounts with no access to any MetaLocator features. The requesting user will receive an email notification that their account is pending review and the account owner will receive an email notification that an account is pending review as shown below:

[![](https://storage.crisp.chat/users/helpdesk/website/-/3/1/a/2/31a243e872729600/b935c3a2-581d-4ec4-8732-d4a5d0_1lxiuzy.png)](https://downloads.intercomcdn.com/i/o/234761143/0c2c9a4b6a751b337950faf4/image.png?expires=1794512700&signature=ccd0c19d7de7563ebb7f09f83a34d444febd2fbae6444eb2d012ed855c3d5be7&req=diMjEc9%2FnIVcFb4f3HP0gMOrfM3S%2BAxR1bXTOvd2gyUJw7E5XJpMJHZEHiFS%0A5GGZaCXqm78J9E6oAQ%3D%3D%0A)

Click the link provided and login as the account owner. Click the username to edit the user. Choose an appropriate [user type](https://support.metalocator.com/en/articles/1656210-user-management):

[![](https://storage.crisp.chat/users/helpdesk/website/-/3/9/5/f/395f8ae6f0f67600/7cfd374c-ec59-4611-9748-333cf2_1yeao30.png)](https://downloads.intercomcdn.com/i/o/234761297/5c5d7321c900564d78da79af/image.png?expires=1794512700&signature=f9fb924d2abeeac45c8a5d0093ace4d3699cf80dc89353d82d5982796964fc35&req=diMjEc9%2Fn4hYFb4f3HP0gEZgcz5xMfNY3mpGdYMBVQDzTwTEAktmAZKjIjGp%0A4hMB2FxQb02d9%2BFKiQ%3D%3D%0A)

Click **Save**, then enable the user as shown below. This triggers an email notification to the new SSO user indicating that their login has been enabled.

[![](https://storage.crisp.chat/users/helpdesk/website/-/7/c/a/9/7ca9431293910800/eed795e1-17d7-4e4e-9364-a0e683_n073v6.png)](https://downloads.intercomcdn.com/i/o/234761372/7b8683dc727e0d82ebff31af/image.png?expires=1794512700&signature=61438e321d95cb71f7652433df377e9a06f667a44e2f54c4c736e722082060ae&req=diMjEc9%2FnoZdFb4f3HP0gIFUuzaBgBq0opv0rVv2MwZTQGWtveeWuZpjcvN%2F%0AwXmq2Z00bFdTdhPpoQ%3D%3D%0A)

The email notification is shown below.

[![](https://downloads.intercomcdn.com/i/o/234761444/8e1fda453ed2c858f09e832f/image.png?expires=1794512700&signature=1a7126ed90ffafe53e47461f300f5ef1680943d91ce0c4d4e4c6a80d63e015f4&req=diMjEc9%2FmYVbFb4f3HP0gAeoIZR88ZFG8lRbqGE0Q35btsi5SYFHIcdqkSnj%0AZwOBmWNZ0jJgIMqk8A%3D%3D%0A)](https://downloads.intercomcdn.com/i/o/234761444/8e1fda453ed2c858f09e832f/image.png?expires=1794512700&signature=1a7126ed90ffafe53e47461f300f5ef1680943d91ce0c4d4e4c6a80d63e015f4&req=diMjEc9%2FmYVbFb4f3HP0gAeoIZR88ZFG8lRbqGE0Q35btsi5SYFHIcdqkSnj%0AZwOBmWNZ0jJgIMqk8A%3D%3D%0A)

When the user logs in, they will now see the resources available to them, based on the type of user chosen above.

## Name ID format

If required, the Name ID format is:

`urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified`