> ## Documentation Index
> Fetch the complete documentation index at: https://syteca.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Configure Okta SSO Integration

> Set up SAML 2.0 Single Sign-On between Okta and the Syteca Management Tool, including the OpenSSL certificate Okta requires.

This page configures SAML 2.0 authentication between Okta and the Syteca Management Tool. See [SSO integration overview](/docs/administration/integrations/sso) for what SSO integration does and the Management Tool settings shared across every provider.

## Prerequisites

Okta SSO requires OpenSSL to generate a signing certificate before configuration begins.

### Generate the certificate

<Steps>
  <Step title="Generate a self-signed x509 certificate">
    Open a Windows command prompt or Linux terminal and run:

    ```bash theme={"system"}
    openssl req -x509 -nodes -days 365 -newkey rsa:1024 -keyout cert.pem -out cert.pem
    ```

    Answer the certificate subject prompts (country, organization, common name, and so on) — these can be left blank where not required.
  </Step>

  <Step title="Export a PKCS12 certificate for Syteca">
    ```bash theme={"system"}
    openssl pkcs12 -export -out cert.pfx -in cert.pem -name SytecaSSO
    ```

    This produces `cert.pfx`, which is uploaded to the Management Tool later. The `cert.pem` file (or its public key) is uploaded to Okta.
  </Step>
</Steps>

## Configure Okta

<Steps>
  <Step title="Create a SAML app integration">
    In Okta, go to **Applications → Applications**, click **Create App Integration**, select **SAML 2.0**, and click **Next**.
  </Step>

  <Step title="Name the application">
    On **General Settings**, enter an **App name** and click **Next**.
  </Step>

  <Step title="Configure the SAML URLs">
    On **Configure SAML**, set both the **Single sign on URL** and **Audience URI (SP Entity ID)** to your Management Tool URL.
  </Step>

  <Step title="Configure advanced settings">
    Click **Show Advanced Settings**:

    * Upload the `cert.pem` x509 certificate in **Signature Certificate**.
    * Set **Single Logout URL** to your Management Tool URL.

    Click **Next**.
  </Step>

  <Step title="Finish the integration">
    On **Feedback**, select **I'm a software vendor** and click **Finish**.
  </Step>

  <Step title="Download the identity provider metadata">
    On **Applications → Application → \<your application> → Sign On**, scroll to **SAML Signing Certificates**, click the **Actions** menu next to **SHA-2**, and select **View IdP metadata**. Save the page as `metadata.xml`.
  </Step>

  <Step title="Assign users">
    On **Applications → Application → \<your application> → Assignments**, select **Assign → Assign to People**, choose the users who should have SSO access, and click **Done**.
  </Step>
</Steps>

## Configure the Management Tool

<Steps>
  <Step title="Open SSO Integration settings">
    Click **Configuration** at the top of the Management Tool, then select the **SSO Integration** tab.
  </Step>

  <Step title="Enter the issuer and upload the metadata">
    Set **Issuer name** to your Management Tool URL, and upload `metadata.xml` under **Identity provider metadata (xml)**.
  </Step>

  <Step title="Upload the custom certificate">
    Select **Custom certificate**, upload `cert.pfx`, and enter the certificate's export password.
  </Step>

  <Step title="Review the auto-create account setting">
    <Note>
      The **Auto-create a Management Tool account for a new user on the first SSO login** checkbox is selected by default. See [SSO integration overview](/docs/administration/integrations/sso#what-every-integration-configures-in-common) for what this controls.
    </Note>
  </Step>

  <Step title="Save and restart the Application Server">
    Click **Save**, then restart the **EkranServer** service in Windows Services to apply the change.

    <Warning>
      `EkranServer` is a literal system identifier, preserved verbatim from source.
    </Warning>
  </Step>
</Steps>

<Note>
  SSO authentication is not currently supported in [Multi-Tenant mode](/docs/administration/multi-tenant/overview).
</Note>

## Related

<CardGroup cols={2}>
  <Card title="SSO integration overview" icon="key" href="/docs/administration/integrations/sso">
    All supported SSO providers and shared Management Tool settings.
  </Card>

  <Card title="Azure SSO" icon="microsoft" href="/docs/administration/integrations/sso-azure">
    Configure SSO through Azure instead.
  </Card>

  <Card title="ForgeRock SSO" icon="lock" href="/docs/administration/integrations/sso-forgerock">
    Configure SSO through ForgeRock instead.
  </Card>

  <Card title="User management" icon="users" href="/docs/administration/users/users">
    Managing Management Tool user accounts and permissions.
  </Card>
</CardGroup>