Skip to content

Configuring SSO with Okta (SAML 2.0)

This guide describes how to configure Single Sign-On (SSO) between Okta and RunMyProcess using the SAML 2.0 protocol. It complements the general SSO with SAML 2.0 documentation by providing Okta-specific step-by-step instructions.

RunMyProcess supports both IdP-initiated SSO (users authenticate via the Okta User Portal) and SP-initiated SSO (users access RunMyProcess directly and are redirected to Okta for authentication).

Prerequisites

Before you begin, ensure you have the following:

  • An Okta administrator account with permissions to create and manage applications.
  • A RunMyProcess account with administrator rights for your organization.
  • Access to the RunMyProcess Account Configuration panel (DigitalSuite > Account > Configuration > Authentication).

Part 1 — Configure the RunMyProcess Application in Okta

Step 1: Add the RunMyProcess Application

  1. Sign in to the Okta Admin Console.
  2. In the left sidebar, navigate to Applications > Applications.
  3. Click Create App Integration and select SAML 2.0 as the sign-on method.
  4. Set the Application label to RunMyProcess and click Next.

Step 2: Configure SAML Settings

On the Configure SAML tab, enter the following values:

Setting Value
Single Sign-On URL https://live.runmyprocess.com/saml/acs
Recipient URL https://live.runmyprocess.com/saml/acs
Destination URL https://live.runmyprocess.com/live/<CUSTOMER_ID>/appli/<APP_ID>?P_mode=LIVE
Audience Restriction (Entity ID) runmyprocess.com
Name ID Format EmailAddress
Response Signed
Assertion Signature Signed
Signature Algorithm RSA_SHA256

Note: Replace <CUSTOMER_ID> and <APP_ID> in the Destination URL with the values specific to your RunMyProcess environment. You can find these in the URL when you access your RunMyProcess Live application.

Step 3: Configure App Settings

On the General tab, review the following settings:

  • Provisioning: Select None (unless you plan to configure SCIM provisioning separately).
  • Application visibility: Configure according to your preference. Check "Do not display application icon to users" if you do not want the app to appear in the Okta user portal.
  • Auto-launch: Leave unchecked unless you want the app to launch automatically when users sign in to Okta.

Step 4: Assign Users

  1. Go to the Assignments tab of the RunMyProcess application in Okta.
  2. Click Assign and select either Assign to People or Assign to Groups.
  3. Assign the application to the users or groups who need access to RunMyProcess.

Step 5: Retrieve Okta Metadata for RunMyProcess Configuration

Before moving to the RunMyProcess side, gather the following information from Okta:

  1. On the Sign On tab of the RunMyProcess application, locate the SAML Signing Certificate section.
  2. Click Actions > Download certificate to download the X.509 certificate. Open it in a text editor and copy the full certificate content (including the -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- lines).
  3. Right-click on Identity Provider metadata and copy the link, or note the following values from the Setup Instructions (click "View SAML setup instructions"):
  4. Identity Provider Single Sign-On URL — this is the SSO redirect URL you will need in RunMyProcess.
  5. Identity Provider Issuer — the Okta entity identifier.

Part 2 — Configure RunMyProcess for SSO

Step 1: Access the Authentication Configuration

  1. Sign in to the RunMyProcess DigitalSuite as an administrator.
  2. Navigate to Account > Configuration > Authentication.
  3. In the left sidebar, under Authentication methods, select the environment you want to configure (e.g., Live, Acceptance, or Test).

Step 2: Set the Authentication Method

In the authentication method form, configure the following fields:

Field Value
Method SSO with Samlv2
SSO redirect https://<your-okta-domain>/app/<app-slug>/exk.../sso/saml
Logout redirect https://<your-okta-domain>
Account management redirect (leave blank)
Sign request (unchecked)
Name ID format urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress
Entity ID runmyprocess.com
Certificate Paste the full X.509 certificate downloaded from Okta
Auto-provisioning (unchecked, unless you want users to be automatically created in RunMyProcess upon their first SSO login)

Important:

  • The SSO redirect value must match the Identity Provider Single Sign-On URL from Okta (Step 5 of Part 1). Remove the https:// prefix, as the field already prepends it.
  • The Logout redirect value should be your Okta domain (e.g., trial-1234567.okta.com). Remove the https:// prefix.
  • The Name ID format must be set to urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress so that the email address is used as the unique identifier between Okta and RunMyProcess.
  • The Entity ID must match the Audience Restriction value configured in Okta.

Step 3: Paste the Certificate

In the Certificate field, paste the entire contents of the X.509 signing certificate you downloaded from Okta. The certificate should look like:

-----BEGIN CERTIFICATE-----
MIIDqjCCApKgAwIBAgIGA...
...
-----END CERTIFICATE-----

Step 4: Save the Configuration

Click the Save icon (blue floppy disk) at the top of the configuration panel to save and enable SSO for the selected environment.

Step 5: Repeat for Other Environments (Optional)

If you need SSO for multiple environments (Live, Acceptance, Test), repeat Step 2 through Step 4 for each environment. Each environment has its own authentication method configuration in the left sidebar under Authentication methods.

Testing the SSO Integration

IdP-Initiated SSO (from Okta)

  1. Sign in to your Okta User Portal.
  2. Click the RunMyProcess tile.
  3. You should be redirected to RunMyProcess and automatically signed in.

SP-Initiated SSO (from RunMyProcess)

  1. Navigate to your RunMyProcess application URL.
  2. You should be redirected to the Okta login page.
  3. After authenticating with Okta, you should be redirected back to RunMyProcess and automatically signed in.

Troubleshooting

Issue Possible Cause Solution
SAML assertion error Mismatched Entity ID Verify that the Audience Restriction in Okta matches the Entity ID in RunMyProcess (both should be runmyprocess.com).
User not found Name ID mismatch Ensure the Name ID Format is set to EmailAddress in Okta and the corresponding urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress in RunMyProcess. The email in Okta must match the user's email in RunMyProcess.
Certificate error Expired or wrong certificate Re-download the signing certificate from Okta and update it in the RunMyProcess configuration.
Redirect loop Incorrect SSO redirect URL Verify that the SSO redirect field in RunMyProcess contains the correct Okta SSO URL (without the https:// prefix).
Logout does not redirect to Okta Incorrect Logout redirect Ensure the Logout redirect field contains your Okta domain (without the https:// prefix).

Reference: SAML Settings Summary

The table below summarizes the key SAML configuration values and where they are set:

Parameter Set In Value
Single Sign-On URL (ACS) Okta https://live.runmyprocess.com/saml/acs
Audience Restriction Okta runmyprocess.com
Name ID Format Okta EmailAddress
Signature Algorithm Okta RSA_SHA256
SSO redirect RunMyProcess Okta SSO URL (without https://)
Logout redirect RunMyProcess Okta domain (without https://)
Name ID format RunMyProcess urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress
Entity ID RunMyProcess runmyprocess.com
Certificate RunMyProcess Okta X.509 signing certificate

See Also