> ## Documentation Index
> Fetch the complete documentation index at: https://docs.retrac.co/llms.txt
> Use this file to discover all available pages before exploring further.

# Okta SAML SSO

> Configure SAML single sign-on between Okta and Retrac.

This guide walks workspace **owners** through connecting **Okta** as a SAML identity provider for Retrac. SAML SSO is available on **Enterprise** plans.

<Note>
  Test in a staging Okta app before enforcing SSO on production users. Keep at least one break-glass owner account with a non-SSO recovery path.
</Note>

## Prerequisites

* Okta admin access
* Retrac workspace owner role
* Enterprise plan with SAML enabled

## Set up Okta SAML

<Steps>
  <Step title="Open Retrac Security settings">
    In Retrac, go to **Settings → Security** and click to configure **SAML Single Sign-On**. Select **Okta** as your identity provider.
  </Step>

  <Step title="Create a SAML app in Okta">
    In the Okta Admin Console, go to **Applications → Create App Integration**.

    Choose **SAML 2.0**, name the app **Retrac**, and continue.
  </Step>

  <Step title="Enter Retrac SP details">
    From the Retrac SAML setup modal, copy the **ACS URL** and **Entity ID**. Enter them in Okta:

    * **Single sign-on URL** — Retrac ACS URL
    * **Audience URI (SP Entity ID)** — Retrac Entity ID
    * **Name ID format** — EmailAddress
    * **Application username** — Email
  </Step>

  <Step title="Copy the metadata URL">
    ## Step 4: Copy the metadata URL

    After saving the Okta SAML app, Okta provides an **Identity Provider metadata URL**.

    1. In Okta, open the **Sign On** tab for the Retrac app.
    2. Under **SAML 2.0**, copy the **Metadata URL** (or download metadata XML).
    3. In Retrac **Settings → Security**, paste the metadata URL into the SAML configuration form.
    4. Save the configuration in Retrac.

    Retrac uses this metadata to trust Okta's signing certificate and SSO endpoint.
  </Step>

  <Step title="Configure attribute statements">
    Ensure Okta sends an email attribute Retrac can use to identify the user:

    | Okta attribute | Retrac expects |
    | -------------- | -------------- |
    | `user.email`   | Email address  |

    Add optional `firstName` and `lastName` attributes if your Retrac setup maps display names.
  </Step>

  <Step title="Assign users and test">
    Assign the Retrac app to Okta users or groups.

    1. Sign out of Retrac.
    2. On the login page, click **Sign in with SAML**, or use Okta dashboard SSO.
    3. Confirm you land in the correct workspace.

    <Tip>
      Use Okta's **View SAML setup instructions** if you need to verify ACS URL and audience values side by side.
    </Tip>
  </Step>
</Steps>

## Remove SAML

Owners can disconnect SAML from **Settings → Security**. Coordinate with your IT team before removing production SSO.

See [Security documentation](/dashboard/security/introduction) and [Okta SCIM](/help/article/okta-scim) for user provisioning.