SSO / SAML Setup

SAML Single Sign-On lets your team members sign in to OKRunit using your company's identity provider (IdP). SSO is available on Business and Enterprise plans.

Quick Setup (5 minutes)

The fastest way to configure SSO is to import your IdP's metadata URL. This auto-fills all the technical details for you.

1. 1
   Create a SAML app in your IdP.

   In your identity provider's admin console, create a new SAML 2.0 application. You'll need to provide these values from OKRunit (found at the bottom of the SSO settings page):

   ACS URL (Assertion Consumer Service)

   https://your-domain.com/api/auth/saml/callback

   Entity ID / Audience URI

   https://your-domain.com/api/auth/saml/metadata

   Name ID Format

   Email Address

2. 2
   Copy your IdP's metadata URL.

   After creating the SAML app, your IdP will provide a metadata URL. This is usually found in the app's "Sign On" or "SAML Settings" section. It looks something like:

   https://your-idp.okta.com/app/abc123/sso/saml/metadata

3. 3
   Import it in OKRunit.

   Go to Settings → SSO, paste the metadata URL into the "Quick Setup" box, and click Import. This auto-fills the Entity ID, SSO URL, and certificate.

4. 4
   Enter your email domain.

   Type your company's email domain (e.g. acme.com). Users with that email domain will be able to sign in with SSO.

5. 5
   Enable and save.

   Toggle "Enable SSO" on and click Save Configuration. Your team can now sign in by clicking "Sign in with SSO" on the login page.

Provider-Specific Guides

Okta

1. In Okta Admin, go to Applications → Create App Integration.
2. Select SAML 2.0 and click Next.
3. Set the Single sign-on URL to your ACS URL and the Audience URI to your Entity ID (shown in OKRunit's SSO settings).
4. For Name ID format, select EmailAddress.
5. Click Next, then Finish.
6. On the app's Sign On tab, find the Metadata URL and paste it into OKRunit's Quick Setup.
7. Assign users or groups to the app in Okta.

Azure AD (Microsoft Entra ID)

1. In the Azure portal, go to Microsoft Entra ID → Enterprise Applications → New Application.
2. Click Create your own application, name it "OKRunit", select "Integrate any other application".
3. Go to Single sign-on → SAML.
4. In Basic SAML Configuration, set the Identifier (Entity ID) and Reply URL (ACS URL) to the values shown in OKRunit's SSO settings.
5. Copy the App Federation Metadata Url from section 3 and paste it into OKRunit's Quick Setup.
6. Assign users or groups to the enterprise application.

Google Workspace

1. In Google Admin, go to Apps → Web and mobile apps → Add app → Add custom SAML app.
2. Name the app "OKRunit" and click Continue.
3. On the Google Identity Provider details page, copy the SSO URL and download the Certificate. You can also copy the Metadata URL if shown.
4. In Service provider details, set the ACS URL and Entity ID to the values from OKRunit's SSO settings. Set Name ID format to EMAIL.
5. If Google provided a metadata URL, paste it into OKRunit's Quick Setup. Otherwise, manually enter the SSO URL and paste the certificate using the "Edit" link.
6. Turn the app ON for the organizational units that should have access.

Manual Configuration

If your IdP doesn't provide a metadata URL, click the "Edit" link on the SSO settings page and enter:

Attribute Mapping

OKRunit needs a few user attributes from your IdP. The defaults work for most providers, but you can customize them if needed.

How Users Sign In with SSO

Once SSO is enabled, your team members sign in like this:

1. 1
   Go to the OKRunit login page and click "Sign in with SSO".
2. 2
   Enter their work email address (e.g. jane@acme.com) and click Continue with SSO.
3. 3
   They're redirected to your company's identity provider to authenticate (password, MFA, etc.).
4. 4
   After authenticating, they're automatically redirected back to OKRunit and signed in. If it's their first time, an account is created automatically and they're added to your organization as a member.

For developers: SSO configuration via API

If you prefer to configure SSO programmatically (e.g. as part of your infrastructure automation), you can use the API:

# Configure SSO for your organization
curl -X PATCH https://okrunit.com/api/v1/org/sso \
  -H "Authorization: Bearer gk_your_api_key" \
  -H "Content-Type: application/json" \
  -d '{
    "saml_metadata_url": "https://your-idp.okta.com/app/.../sso/saml/metadata",
    "email_domain": "acme.com",
    "enabled": true
  }'

Frequently Asked Questions