Skip to content

Set Up an Okta Application

Ensure that you have Administrator access to your Okta Account and Trust3 AI.

Follow these steps to create and configure an Okta application for Single Sign-On (SSO):

Step 1: Log in to Your Okta Admin Console

  1. Log in using your administrator credentials.

Step 2: Create a New Application

  1. In the Admin Console, navigate to Applications from the left-side menu.
  2. Click on Applications under the Applications tab.
  3. On the Applications page, click Create App Integration.

Step 3: Choose SAML 2.0

  1. In the Create a New Application Integration dialog, select SAML 2.0 as the sign-in method.
  2. Click Next to proceed.

Step 4: General Settings

  1. In the General Settings section, provide a descriptive name for your application in the App name field.
    For example: Trust3 AI SAML-SSO
  2. (Optional) Upload a logo for the application if needed.
  3. Click Next to proceed to the SAML Settings page.

Step 5: Configure SAML Settings

  1. In the SAML Settings section, fill in the following fields:

    Field Value Example
    Single sign-on URL https://na.trust3ai.com/SingleSignOnService/receiveResponse
    Audience URI (SP Entity ID) trust3ai_portal

  2. Scroll down to the Attribute Statements section to map user attributes:

    Name Name format Value Optional/Required
    UserId Unspecified user.login Required
    Email Unspecified user.email Required
    FirstName Unspecified user.firstName Optional
    LastName Unspecified user.lastName Optional

  3. Click Next to proceed.

Step 6: Assign Users to the Application

  1. Go to the Assignments tab of the newly created application.
  2. Click Assign and select Assign to People or Assign to Groups.
  3. Choose the users or groups you want to assign and click Done.

Important

It is assumed that the user is already mapped with the appropriate groups before being assigned to the application in Okta.

Step 7: Optional - Configure Group Attribute

  1. In the Sign On tab, scroll down to Group Attribute Statements.

  2. Add a group attribute statement to map user groups:

    Name Filter Type Filter Value Example Description
    Group Starts with Engineering Matches all groups starting with "Engineering".
    Contains Team Matches all groups containing the word "Team".
    Equals AdminGroup Matches only the group named "AdminGroup".
    Matches Regex ^(Engineering|Compliance|Legal).* Matches groups starting with "Engineering", "Compliance", or "Legal".

  3. Click Save to apply the group-based mapping.

Step 8: Feedback

  1. On the Feedback page, select I'm an Okta customer adding an internal app.
  2. Click Finish to complete the initial setup.
  1. Go to the Sign On tab of the newly created application.
  2. Scroll down to the Settings section.
  3. Click on Metadata URL to download the metadata XML file.
    This file will be used for configuring the SSO in the Trust3 AI portal.
  4. Go to the General tab.
  5. Scroll down to the Embed Link section.
  6. Copy the Embed Link URL for the Identity Provider Url in the Trust3 AI portal.

You have now successfully set up an Okta application for SAML SSO in the Okta console. This application is ready to be integrated with the Trust3 AI portal.

Configure Okta in your Trust3 AI account.

In Trust3 AI, follow these steps to access the Single Sign-On settings:

  1. Go to the Settings menu.
  2. Navigate to Identity.
  3. Enable Single Sign-On.

Reference image from Trust3 AI for better guidance: Trust3 AI portal SSO settings

Display Name Description Example Value Optional/Required
Entity Id Entity ID for SAML configuration trust3ai_portal Required
Identity Provider Url Identity Provider URL https://dev-123456.okta.com/home/trust3portal/0oahmmy2ezfMQBeUl5d7 Required
Identity Provider Metadata Metadata (XML file) sso_saml.xml Required
UserName Attribute UserName attribute for SAML user UserId Required
Email Attribute Email attribute for SAML user Email Required
FirstName Attribute FirstName attribute for SAML user FirstName Optional
LastName Attribute LastName attribute for SAML user LastName Optional

Username Conversion in SSO

This setting determines how usernames are generated during SSO login when the Username Attribute value contains an email address.

Username Format Options

  • When the toggle is ON: The system uses the email prefix (the part before @) as the username. Example: jane.doe@xyz.com → jane.doe

  • When the toggle is OFF: The system uses the full email address as the username. Example: jane.doe@xyz.com → jane.doe@xyz.com

Important Considerations

Possible Conflict: Email Already in Use

A conflict may occur if the email address is already associated with another user in the system. This may prevent successful login or account linking during SSO authentication.

Example Scenario: When a user attempts to log in with email jane.doe@xyz.com, but this email is already associated with username jane.doe, the login will fail due to the conflict.

Resolution Steps: An administrator must delete the existing user from Settings → Users, then ask the user to sign in via SSO again.

Configuration Impact

  • New SSO logins will use the configured username format
  • Existing users will be affected by this change on their next login attempt.

Troubleshooting

If you experience issues with SSO login, refer to the SSO Login Troubleshooting Guide for detailed steps and solutions.

Important

  • Entity ID: Used to configure the Identity Provider (IdP).
  • Identity Provider URL: The URL obtained in Step 9, where users will be redirected for SSO login.
  • Identity Provider Metadata: Use the Metadata XML file downloaded in Step 9 for seamless SSO configuration.
  • User Attributes: Ensure that the correct user attributes (UserId, Email, FirstName, LastName) are mapped from Okta to Trust3 AI.

These variables ensure seamless integration between Okta and Trust3 AI for SAML-SSO.

Role Mapping For Okta

Role mapping allows you to translate roles or groups from your Identity Provider (IdP) — such as Okta, Ping Identity, OneLogin, etc. — into specific roles within Trust3 AI. This is crucial for ensuring that users have the correct permissions and access when they log into Trust3 AI.

What is Role Name Attributes?

This attribute in your Identity Provider (IdP) contains the user’s roles or group information. It identifies the roles or groups the user belongs to in the Identity Provider (IdP).

What is Role Mapping?

This configuration maps roles or groups from the Identity Provider (IdP) to corresponding roles in Trust3 AI. If a specific role from the IdP matches a role defined in the role mapping configuration, that role is assigned to the user in Trust3 AI. If no mapping is defined, the default role, ROLE_USER, is automatically assigned to the user.

Variable Name Description Example
Role Name Attribute Role name attributes for user. department
Role Mapping Role mapping for user. Identity Provider (IdP) Role: example_role → Example Role: ACCOUNT_ROLE

Reference image of Role Mapping from Trust3 AI: Trust3 AI portal SSO role mapping

Example:

  • Identity Provider (IdP) Role or Group: okta_role_admin
  • Mapped Trust3 AI Role: ACCOUNT_ADMIN

In this example, if a user has the role okta_role_admin in Okta, they will automatically be assigned the ACCOUNT_ADMIN role in Trust3 AI.

Important

New Users:
Role mapping applies only to newly created users after the mapping has been configured.

By properly configuring role mapping, you ensure that users are granted appropriate access levels within Trust3 AI based on their roles or group memberships from the Identity Provider (IdP). This simplifies user management and ensures seamless integration with your organization’s existing identity infrastructure.

Once the configuration is complete, you can test the setup by attempting to log in to the Trust3 AI portal using your Okta credentials. This will help verify that the Single Sign-On (SSO) integration is working correctly.