Integrations > Security
SSO with Okta
Create a SAML 2.0 app integration in Okta so your team can sign in to SuperFunnel with their Okta account.
Overview
This guide walks an Okta administrator through creating the SuperFunnel application in the Okta Admin Console, assigning users to it, and collecting the three values SuperFunnel support needs to finish the setup.
Start with the main SSO guide
Read Single Sign-On first. You need the ACS URL and Entity ID below, and your team members must already exist in SuperFunnel.
What this guide covers
- Creating the Okta application, assigning users, and collecting the values support needs
- Troubleshooting
Step-by-Step Guide to Creating the Okta Application
Create a SAML 2.0 app integration
In the Okta Admin Console, go to Applications and Resources > Applications, click Create App Integration, choose SAML 2.0 as the sign-in method, then click Next. The Create SAML Integration wizard has three steps: General Settings, Configure SAML, and Feedback.
Name the app
Under General Settings, set App name to SuperFunnel. Adding a logo
is optional and only affects how the tile looks on your users' dashboard.
Click Next.
Configure SAML
This is the step that matters. Fill in:
| Field | Value |
|---|---|
| Single sign-on URL | https://auth.superfunnel.ai/__/auth/handler |
| Audience URI (SP Entity ID) | https://app.superfunnel.ai |
| Name ID format | EmailAddress |
| Application username | Email |
Name ID format offers Unspecified, EmailAddress, x509SubjectName, Persistent and Transient. Application username offers Okta username, Okta username prefix, Email, Email prefix, Custom and (None). Leave Update application username on as Create and update.
Leave Default RelayState empty, and leave Use this for Recipient URL and Destination URL checked.
Name ID must be the email address
SuperFunnel identifies people by email address. If Name ID format is
left as Unspecified or Application username sends an Okta username
that is not an email address, sign-in will fail.
Attribute statements are optional
SuperFunnel reads the email address from the Name ID, so you do not need
any attribute statements. Adding email, firstName and lastName does
no harm if your standard template includes them.
Check the assertion before you leave this step
Click Preview the SAML Assertion at the bottom of the page. In the XML
it generates, confirm the NameID is the user's email address and the
Audience matches the Entity ID above.
Click Next.
Finish the wizard
On the Feedback step, tick This is an internal app that we have created under App type. The remaining questions disappear, since they only apply to apps being submitted to the Okta Integration Network. Click Finish.
Assign users and groups
Open the Assignments tab, then click Assign and choose Assign to People or Assign to Groups. Find the person, click Assign next to them, then Save and Go Back, then Done.
Nobody can sign in until they are assigned
This step is easy to skip and it is the most common first-try failure.
An unassigned user gets User is not assigned to the client application
from Okta and never reaches SuperFunnel.
Assignment does not create members
Assigning someone in Okta lets them authenticate. They also need to exist under Settings > Profile & Team > Members in SuperFunnel, with the same email address, or they will be signed in and then blocked. See Team Management.
Collect the three values for support
Open the Sign On tab. The simplest option is the Identity Provider metadata link in the SAML Signing Certificates area: it returns an XML document holding all three values we need, so you can send us the link or the file and skip copying anything by hand.
If you would rather copy the values individually, click View SAML setup instructions in the same area. You are looking for:
| Value | Shape |
|---|---|
| Identity Provider Issuer | http://www.okta.com/exk... |
| Identity Provider Single Sign-On URL | https://YOUR-ORG.okta.com/app/YOUR-APP/exk.../sso/saml |
| X.509 Certificate | a PEM block starting -----BEGIN CERTIFICATE----- |
Send them to support@superfunnel.ai.
The certificate is not a secret
It is the public half of Okta's signing key, so emailing it is fine. Do check its expiry date, though, since SSO stops working the day it lapses.
Test the first sign-in
Once support confirms your provider is live, pick one person who is both assigned in Okta and a member in SuperFunnel. Ask them to open app.superfunnel.ai, click Sign in With SSO, and enter their work email address.
Working sign-in
They should be redirected to Okta, authenticate under your usual policies, and land in their SuperFunnel workspace. Now assign the rest of the team.
Troubleshooting
Summary
You created a SAML 2.0 app integration in Okta, pointed it at our ACS URL and Entity ID, set the Name ID to the user's email address, assigned your users, and sent back your Okta SSO URL, issuer, and certificate. Once support enables the provider, your team signs in with Sign in With SSO.