Okta SSO Setup

Updated by Amy Thomas

If you use Okta as your Single Sign-On provider, here are the steps you or your IdP admin need to complete in order to create an integration between your Okta and Criteria accounts.

Create a SAML app in Okta

  1. Open the Admin Dashboard.
You must be in the Admin Console to create a SAML app.
  1. In the left menu, choose Applications, and then choose Applications.
  2. On the Applications page, choose Create App Integration.
  3. In the Create a new app integration dialog, select SAML 2.0 for the Sign on method.
  4. Click Next.

Configure SAML integration for your Okta app

1️⃣ General Settings
  1. On the Create SAML Integration page, under General Settings, enter HireSelect_SSO as the app name.
  2. (Optional) Upload a logo and choose the visibility settings for your app.
  3. Click Next.
2️⃣ Configure SAML
  1. Under SAML Settings > General, for Single sign on URL, enter https://hireselect.auth.us-east-1.amazoncognito.com/saml2/idpresponse
  2. Check that Use this for Recipient URL and Destination URL is ticked.
  3. For Audience URI (SP Entity ID), enter urn:amazon:cognito:sp:us-east-1_tkdHRnjPD
  4. Click Next.
3️⃣ Feedback
  1. Choose a feedback response for Okta Support.
  2. Click Finish.
Application Integration > Sign On

The application integration has been created. Go to the Sign On tab.

  1. Under Attribute Statements, click Show legacy configuration.
  2. Click Edit.
  3. Add the following name-value pairs under Profile attribute statements:
    1. For Name, enter the SAML attribute http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress. For Value, enter user.email
    2. For Name, enter: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/firstname. For Value, enter user.firstName 
    3. For Name, enter: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/lastname  For Value, enter user.lastName 

For all other settings on the page, leave them as their default values or set them according to your preferences.

  1. Click Save.

Get the IdP metadata for your Okta application

  1. On the Sign On tab for the Criteria app integration, find the Metadata URL and click Copy.
  2. Send the IdP Metadata URL or xml file to our Support Team (Idp Metadata URL is preferred so xml files will auto-update).

Click here for the next steps in the SSO integration setup process.

Parameters Needed

Here is a recap of the parameters required to set up an integration between Okta and Criteria.

Criteria Provided Parameters:
  1. Entity ID (Audience URI): urn:amazon:cognito:sp:us-east-1_tkdHRnjPD 
  2. Assertion Consumer Service URL: https://hireselect.auth.us-east-1.amazoncognito.com/saml2/idpresponse 
  3. First-Time Sign-On URL/BookMark: https://hireselect.criteriacorp.com/?companyAccountId=<companyAccountId> 
    1. To be provided
  4. Our Required SAML Attributes
    1. First Name
    2. Last Name
    3. Email Address
  5. Optional SAML Attributes
    1. Job Title
    2. Idp Immutable Global Unique Identifier (Varies by Idp) 
    3. http://schemas.xmlsoap.org/ws/2005/05/identity/claims/isDevelopOnly
      1. This will dictate whether the user only has access to your Develop account when they sign in for the first time via SSO, provided they don't already have access to your Criteria recruitment account.
      2. The values for this attribute are either 0 or 1. If the user will only have access to your Develop account and not your Criteria recruitment platform account, select 1. If the user is to have access to both your Develop account and your Criteria recruitment account, select 0.
Customer Provided Parameters:
  1. Federation Metadata Document endpoint URL (Can also be an XML Document but URL preferred)
PLEASE NOTE: The terminology for the attributes for your company may not be an identical match to the attribute names in the SSO setup page. In that case, you can input the most closely related attribute on your end. For example, If the attribute on the SSO setup page lists “givenname” you can input the user’s first name.  

How did we do?