Skip to main content

Okta SAML Setup Guide

Prerequisites: Enterprise plan on Hober | Okta admin access

Before you begin​

Collect the SP metadata values for your tenant from the Hober Dashboard:

  1. Log in to the Hober Dashboard as an admin.
  2. Navigate to Settings → Security → SAML.
  3. Copy the ACS URL and SP Entity ID displayed on the page.

The values follow this pattern:

FieldValue
ACS URLhttps://app.hober.io/v1/auth/saml/{tenantId}/acs
SP Entity IDhttps://app.hober.io/saml/{tenantId}

Step 1: Create a SAML 2.0 app in Okta Admin Console​

  1. Sign in to your Okta Admin Console (https://<your-org>.okta.com/admin).
  1. In the left sidebar, click Applications → Applications.
  1. Click Create App Integration.
  1. In the dialog that appears:
    • Select SAML 2.0 as the sign-in method.
    • Click Next.
  1. On the General Settings tab:
    • App name: Hober Dashboard (or any name that identifies this integration)
    • App logo: upload your logo or leave blank.
    • Click Next.

Step 2: Configure ACS URL and SP Entity ID​

On the Configure SAML tab:

  1. Single sign-on URL (ACS URL): paste the ACS URL from the Hober Dashboard.

    https://app.hober.io/v1/auth/saml/{tenantId}/acs

  2. Check Use this for Recipient URL and Destination URL.

  3. Audience URI (SP Entity ID): paste the SP Entity ID from the Hober Dashboard.

    https://app.hober.io/saml/{tenantId}

  4. Name ID format: select EmailAddress.

  5. Application username: select Email (Okta email).

  6. Leave all other fields at their defaults.

Step 3: Configure attribute statements​

Scroll down to Attribute Statements (optional) and add the following rows:

NameName formatValue
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddressURI Referenceuser.email
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameURI Referenceuser.displayName
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givennameURI Referenceuser.firstName
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surnameURI Referenceuser.lastName
http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsURI Referenceuser.groups

Note on Okta OID URNs: If your Okta configuration sends OID-style attribute names (e.g. urn:oid:0.9.2342.19200300.100.1.3 for email), you can update the attribute_mapping for your tenant via the Hober API. See Attribute mapping reference below.

Click Next, then on the Feedback tab select I'm an Okta customer adding an internal app, and click Finish.

Step 4: Download the Okta IdP metadata XML​

  1. After finishing the wizard you land on the app's Sign On tab.

  1. Scroll down to SAML Signing Certificates (or Metadata details).

  2. Click View SAML setup instructions (or the Identity Provider metadata link in newer Okta versions).

  1. In the setup instructions page, scroll to the bottom and copy the full XML block labelled Optional: Provide the following IDP metadata to your SP provider, or click the Identity Provider metadata link to download the XML file directly.

Save the XML as a file — you will upload it in the next step.

Step 5: Upload metadata in Hober Dashboard​

  1. Log in to the Hober Dashboard as an admin.
  2. Navigate to Settings → Security → SAML.
  1. Click Upload IdP Metadata.
  2. Select the XML file you downloaded from Okta (or paste the XML directly into the text area).
  3. Click Save.

Hober validates the XML on upload. If it contains an error you will see a validation message explaining what is wrong.

Step 6: Assign users in Okta​

Before testing, make sure at least one user is assigned to the Hober app in Okta:

  1. In the Okta Admin Console, open the Hober app and click the Assignments tab.
  2. Click Assign → Assign to People (or Assign to Groups for group-based access).
  3. Assign at least your own user account and click Done.

Step 7: Test SSO login​

  1. In a private/incognito browser window, navigate to:

    https://app.hober.io/v1/auth/saml/login?tenantSlug=<your-tenant-slug>

  2. You should be redirected to the Okta sign-in page.

  3. Enter your Okta credentials (and complete MFA if required).

  4. You should be redirected back to the Hober Dashboard, logged in.

If the login fails, see the Troubleshooting guide.

Attribute mapping reference​

The table below shows the Okta claim names (using the default Microsoft schema URI format) and how they map to Hober user fields. This matches Hober's default attribute_mapping.

Hober user fieldOkta attribute name (URI Reference)Okta user property
emailhttp://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddressuser.email
namehttp://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameuser.displayName
given_namehttp://schemas.xmlsoap.org/ws/2005/05/identity/claims/givennameuser.firstName
family_namehttp://schemas.xmlsoap.org/ws/2005/05/identity/claims/surnameuser.lastName
groupshttp://schemas.microsoft.com/ws/2008/06/identity/claims/groupsuser.groups

Alternative: Okta OID URN format​

Okta can also send attributes using OID URNs. If your Okta app sends email as urn:oid:0.9.2342.19200300.100.1.3 instead of the Microsoft schema URI, update the attribute_mapping for your tenant using the Hober API:

PUT /v1/auth/saml/config?tenantSlug=<your-tenant-slug>
Content-Type: application/xml

<your IdP metadata XML>

Then update the attribute mapping via the SAML config API (contact Hober support to update attribute_mapping via API if the Dashboard UI does not yet expose this field).