4

SSO

Last Update hace 14 horas

Single Sign-On (SSO) Overview Set Up SSO with Google Workspace Set Up SSO with Microsoft Entra ID Set Up SSO with Okta

Set Up SSO with Okta

Connect Okta to BounceBan with SAML 2.0 or OpenID Connect, with optional SCIM provisioning and team roles from Okta groups.

Gavin

Last Update hace 14 horas

This guide shows how to connect Okta to BounceBan. For how SSO works in BounceBan, see the Single Sign-On (SSO) overview.
You can use either SAML 2.0 or OpenID Connect (OIDC). Both support sign-in from the Okta dashboard, SCIM provisioning and team roles from groups.
Before you start
  • SSO must be turned on for your BounceBan team (contact your account manager or [email protected]).
  • You need to be the BounceBan team owner or a team admin, and an Okta administrator.
  • Open your BounceBan SSO page: https://bounceban.com/app/account/sso.
  • Verify your email domain in step 1 of the SSO page first (see the overview).
Okta's admin console changes from time to time; button names may differ slightly in your Okta org.
Option A: SAML 2.0
1. Create the app in Okta
  1. In the Okta Admin Console, go to Applications > Applications and click Create App Integration.
  2. Choose SAML 2.0 and click Next.
  3. Name the app (for example "BounceBan") and click Next.
  4. On the BounceBan SSO page, in step 2, choose SAML 2.0. Copy the values under Enter these in your identity provider into Okta:
    • Single sign-on URL: BounceBan's ACS URL (Reply URL)
    • Audience URI (SP Entity ID): BounceBan's Entity ID (Audience URI)
    • Name ID format: EmailAddress
    • Application username: Email
  5. Optional: to send groups for team roles, see "Team roles from Okta groups" below. You can also add it later.
  6. Finish creating the app.
  7. On the app's Assignments tab, assign the people or groups who should use BounceBan.
The BounceBan values look like https://bounceban.com/sso/saml/
2. Copy Okta's settings into BounceBan
  1. On the app's Sign On tab in Okta, copy the Metadata URL.
  2. On the BounceBan SSO page, paste it in IdP metadata URL (optional) and click Load. This fills in IdP Entity ID (Issuer), IdP SSO URL (Login URL) and the Signing certificates.
  3. Click Save.
Using the metadata URL also lets BounceBan pick up Okta's new signing certificates automatically (it checks the URL every day).
If you can't use the metadata URL, open View SAML setup instructions in Okta and copy the Identity Provider Issuer, Identity Provider Single Sign-On URL and X.509 Certificate into the matching BounceBan fields, then click Save.
3. Optional: sign in from the Okta dashboard
To let people open BounceBan from their Okta dashboard, turn on Allow sign-in from the identity provider's app dashboard (IdP-initiated) in step 3 of the SSO page.
Option B: OpenID Connect
1. Create the app in Okta
  1. In the Okta Admin Console, go to Applications > Applications and click Create App Integration.
  2. Choose OIDC - OpenID Connect and Web Application, and click Next.
  3. Name the app (for example "BounceBan").
  4. Grant type: Authorization Code.
  5. On the BounceBan SSO page, in step 2, choose OpenID Connect. Copy:
    • Redirect URI → Okta Sign-in redirect URIs.
    • Optional, for sign-in from the Okta dashboard: Initiate login URI → Okta Initiate login URI (set Login initiated by to Either Okta or App).
  6. Under Assignments, choose who can use the app, and click Save.
BounceBan requests the scopes openid email profile.
2. Copy Okta's settings into BounceBan
On the BounceBan SSO page, fill in:
  • Issuer URL: your Okta org URL, for example https://yourcompany.okta.com. It must exactly match the issuer in Okta's OpenID configuration (https://yourcompany.okta.com/.well-known/openid-configuration).
  • Client ID and Client secret: from the app's General tab in Okta.
Click Save. BounceBan checks the issuer when you save and shows an error if it doesn't match.
Test and turn on SSO sign-in
  1. In step 3 of the BounceBan SSO page, click Test connection and sign in with your own Okta account (it must be assigned to the app).
  2. Check the result: it should show an email address on your verified domain.
  3. Turn on Turn on SSO sign-in.
People can now sign in at https://bounceban.com/account/sso with their work email.
Optional: SCIM provisioning
With SCIM, Okta creates BounceBan accounts for people you assign to the app, updates them, and deactivates them when they are unassigned or deactivated in Okta.
  1. In step 4 of the BounceBan SSO page, click Generate token and copy it. You won't be able to see it again.
  2. In Okta, open the app's General tab, click Edit under App Settings, set Provisioning to SCIM, and save.
  3. On the new Provisioning tab, under Integration, click Edit and enter:
    • SCIM connector base URL: the SCIM base URL (Tenant URL) from BounceBan (https://bounceban.com/scim/v2).
    • Unique identifier field for users: userName
    • Supported provisioning actions: Push New Users and Push Profile Updates. Leave Push Groups off; BounceBan doesn't support group provisioning.
    • Authentication Mode: HTTP Header, and paste the token as the Bearer token.
  4. Click Test Connector Configuration, then Save.
  5. Under Provisioning > To App, click Edit and turn on Create Users, Update User Attributes and Deactivate Users. Save.
Only people with email addresses on your verified domains can be provisioned. When someone is unassigned or deactivated in Okta, they can no longer sign in to BounceBan, their sessions end and all their API keys are replaced.
Team roles from Okta groups
To make people BounceBan team admins based on their Okta groups, send the groups in the SAML assertion or the OIDC token.
  1. In Okta, open the app's Sign On tab.
  2. Click Add expression:
    • SAML: under Attribute statements.
    • OpenID Connect: under Token claims.
  3. Name it groups (or the name you enter in BounceBan's Groups attribute or claim).
  4. Use an expression that lists the names of the groups that matter. For example, for groups whose names start with "BounceBan":
5. Save.
The older group attribute statement (SAML) and groups claim filter (OIDC), under Show legacy configuration, also work.
For OpenID Connect, this applies when your Issuer URL is your Okta org URL. If you use a custom authorization server (such as /oauth2/default), add the groups claim to that authorization server's ID token instead.
Then, in step 5 of the BounceBan SSO page:
  1. Keep Groups attribute or claim as groups (or the name you chose).
  2. Under Admin groups, enter the Okta group names whose members should be admins, one per line (up to 20, not case-sensitive).
  3. Click Test connection in step 3 to check the groups Okta sends and the role you'd get.
  4. Turn on Set team roles from these groups and click Save.
Roles are updated each time someone signs in with SSO. People in none of the admin groups, or whose groups aren't sent, become members. The team owner's role doesn't change.
Troubleshooting
The test says the SAML response could not be verified.
Check that the Single sign-on URL and Audience URI in Okta exactly match the ACS URL and Entity ID on your SSO page, and that the IdP Entity ID and certificate in BounceBan match Okta. Click Load again to refresh them from the metadata URL, then save and test again.
"The issuer URL doesn't match the issuer in its OpenID Connect configuration."
Enter the issuer exactly as shown in the error (for example, without a trailing slash, or with /oauth2/default if you use a custom authorization server).
The test shows no groups.
Check the expression name matches Groups attribute or claim, and that your test user is in a group the expression matches.
People get "SSO sign-in failed" or are sent back to the sign-in page.
Make sure they are assigned to the app in Okta, and that their Okta email address is on a verified domain.
For more answers, see the SSO overview FAQ.

Was this article helpful?

0 out of 0 liked this article

Still need help? Message Us