Okta SAML SSO feature is a paid feature.

If you’re using Infisical Cloud, then it is available under the Pro Tier. If you’re self-hosting Infisical, then you should contact [email protected] to purchase an enterprise license to use it.

  1. In Infisical, head over to your organization Settings > Authentication > SAML SSO Configuration and select Set up SAML SSO. Next, copy the Single sign-on URL and Audience URI (SP Entity ID) to use when configuring the Okta SAML 2.0 application.

Okta SAML initial configuration

  1. In the Okta Admin Portal, select Applications > Applications from the navigation. On the Applications screen, select the Create App Integration button.

SAML Okta create app integration

  1. In the Create a New Application Integration dialog, select the SAML 2.0 radio button:

SAML Okta create SAML 2.0 integration

  1. On the General Settings screen, give the application a unique name like Infisical and select Next.

SAML Okta create SAML 2.0 integration

  1. On the Configure SAML screen, set the Single sign-on URL and Audience URI (SP Entity ID) from step 1.

SAML Okta configure IdP fields

If you’re self-hosting Infisical, then you will want to replace https://app.infisical.com with your own domain.

  1. Also on the Configure SAML screen, configure the Attribute Statements to map:
  • id -> user.id,
  • email -> user.email,
  • firstName -> user.firstName
  • lastName -> user.lastName

SAML Okta attribute statements

Once configured, select Next to proceed to the Feedback screen and select Finish.

  1. Get IdP values

Once your application is created, select the Sign On tab for the app and select the View Setup Instructions button located on the right side of the screen:

SAML Okta view setup instructions

Copy the Identity Provider Single Sign-On URL, the Identity Provider Issuer, and the X.509 Certificate to use when finishing configuring Okta SAML in Infisical.

SAML Okta IdP values

Back in Infisical, set Identity Provider Single Sign-On URL, Identity Provider Issuer, and Certificate to X.509 Certificate from above. Once you’ve done that, press Update to complete the required configuration.

SAML Okta paste values into Infisical

  1. Finally, navigate to the Assignments tab and select Assign

You can assign access to the application on a user-by-user basis using the Assign to People option, or in-bulk using the Assign to Groups option.

SAML Okta assignment

At this point, you have configured everything you need within the context of the Okta Admin Portal.

  1. Return to Infisical and enable SAML SSO.

Enabling SAML SSO enforces all members in your organization to only be able to log into Infisical via Okta.

SAML Okta assignment