This article explains how to configure Single Sign-On (SSO) - the ability for users to authenticate to Assure using a single set of corporate credentials managed by an external identity provider - using Okta as the identity provider (IdP) and the SAML 2.0 protocol. The configuration requires creating a new Okta App Integration, supplying Assure-specific endpoint URLs (incorporating the customer's stack and customer key), setting the correct cryptographic algorithm values, and extracting the Okta metadata URL to share with the Evotix implementation consultant. This process is cross-module: once configured, SSO applies to all Assure modules accessed by end users.
Prerequisites
- STACK -- the regional stack identifier for your Assure instance (for example:
uk,uk2,na,anz) - CUSTOMERKEY -- the unique identifier assigned to your organisation's Assure environment
- Access to the Okta Admin Console with Super Admin permissions
Configuration Steps
Step 1: Create a New App Integration
- In the Okta Admin Console, navigate to Applications.
- Select Create App Integration.
- Choose SAML 2.0 as the sign-on method.
- Click Next.
Step 2: Name the Application
- Enter a recognisable name for the application (for example,
Assure). - Click Next.
Step 3: Configure SAML Settings
| Field | Value |
|---|---|
| Single Sign On URL | https://ids.<STACK>.sheassure.net/core/saml-<CUSTOMERKEY>/signin |
| Audience URI (SP Entity ID) | https://ids.<STACK>.sheassure.net/saml-<CUSTOMERKEY> |
| Name ID Format | EmailAddress |
Replace<STACK>and<CUSTOMERKEY>with the values specific to your Assure instance.
- Single Sign On URL:
https://ids.uk.sheassure.net/core/saml-acmecorp/signin - Audience URI:
https://ids.uk.sheassure.net/saml-acmecorp
Optional: Okta Portal Launch (Attribute Statement)
| Field | Value |
|---|---|
| Name | tenant |
| Name Format | Basic |
| Value | <CUSTOMERKEY> |
Step 4: Complete the Okta Wizard
- Click Next.
- Select "I'm an Okta customer adding an internal app".
- Click Finish.
Step 5: Verify Algorithm Settings
- Navigate to the General tab of the newly created app integration.
- Confirm the following cryptographic algorithm settings are applied:
| Setting | Required Value |
|---|---|
| Signature Algorithm | RSA_SHA256 |
| Digest Algorithm | SHA256 |
Step 6: Access the SAML Setup Instructions
- Navigate to the Sign On tab of the app integration.
- Click "View SAML setup instructions".
- Locate the Identity Provider Single Sign-On URL displayed on that page.
Step 7: Derive and Share the Metadata URL
- Remove the application name segment (the portion shown between
/app/and the app key). - Append
/metadatato the end of the URL.
https://company.okta.com/app/applicationname/exk6e1y4aqdyfhju417/sso/saml/
https://company.okta.com/app/exk6e1y4aqdyfhju417/sso/saml/metadata
Key Values Reference
| Placeholder | Description |
|---|---|
<STACK> | Regional stack (e.g. uk, uk2, na, anz) |
<CUSTOMERKEY> | Unique customer identifier for your Assure environment |
AI Metadata
- Product Area: Authentication / Identity Management
- User Role: IT Administrator, Evotix Implementation Consultant
- Tags: SSO, Single Sign-On, Okta, SAML, SAML 2.0, authentication, identity provider, app integration, configuration
- Version/Region: All regions (UK, UK2, NA, ANZ)
- Important Synonyms: Single Sign-On = SSO; Okta = identity provider (IdP); Audience URI = SP Entity ID; Signature Algorithm = RSA_SHA256; Digest Algorithm = SHA256
- Suggested Embedding Keywords: Okta SSO setup, SAML 2.0 Assure configuration, Okta app integration Assure, Okta metadata URL Assure, Assure identity provider configuration, Assure Okta attribute statement, Assure Okta sign-on, SSO Okta CUSTOMERKEY, Assure SAML endpoint
- Relevant Modules: Authentication (cross-module: affects all Assure modules that require user login)
- Cross-Module Implications: Configuring SSO via Okta affects the login mechanism for all Assure modules. All user authentication is routed through the configured identity provider once SSO is enabled.