---
title: "How to configure Okta as an IDP"
slug: "how-to-configure-okta-as-an-idp"
updated: 2023-11-09T13:32:04Z
published: 2023-11-09T13:32:04Z
canonical: "docs.ssw.splashtop.com/how-to-configure-okta-as-an-idp"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ssw.splashtop.com/llms.txt
> Use this file to discover all available pages before exploring further.

# How to configure Okta as an IDP

## Supported Features

The Okta/Splashtop Secure Workspace integration currently supports the following features:

- SAML
  - SP-initiated SSO
- OIDC
  - SP-initiated SSO
- SCIM
  - Create users
  - Update user attributes
  - Deactivate users
  - Group push

For more information on the listed features, visit the [Okta Glossary](https://help.okta.com/en/prod/Content/Topics/Reference/glossary.htm).

## Configuration Steps

## OKTA SAML setup

### Step 1: Accessing the Identity Providers Section

1. Log in to your Splashtop Secure Workspace admin account using your credentials.
2. Navigate to the **Settings** tab.
3. Click on the **Identity Providers** section.

### Step 2: Adding a New SAML IDP

1. In the Identity Providers section, click on the **Add New** button.
2. Select **SAML** from the available options.

![image.png](https://cdn.document360.io/efce33ac-4fef-4586-80ea-16e488013376/Images/Documentation/image%2816%29.png)

### Step 3: Configuring the SAML IDP

1. Enter the **Display Name** for the SAML IDP.
2. Set the **Enabled** option to enable the SAML IDP.
3. In the upcoming steps, we will utilize the **Redirect URL** and **Entity ID** located in the upper right corner of the page.
4. Open a new tab to log in to the **OKTA admin** portal to open **Applications** → **Browse App Catalog →** Search for **Splashtop Secure Workspace →** Choose **Splashtop Secure Workspace → Add Integration**
5. After add the **Application label** go to next page, then select **SAML 2.0**, fill in the **Redirect URL** and **Entity ID** we get in previous step, and change **Application username formate** to **Email** then click the **Done** button.
6. After the Application is created, go to **Sign On** tab → **SAML Signing Certificates** → choose the **Active**  cert → **View IdP metadata**

![Untitled1.png](https://cdn.document360.io/efce33ac-4fef-4586-80ea-16e488013376/Images/Documentation/Untitled1.png)

1. Open it in a new tab and then save it as metadata.xml
2. Go to **Assignments** → assign the people/groups you like to assign to access the Splashtop Secure Workspace.
3. Go back to the Splashtop Secure Workspace IDP config page, dragging and dropping the IDP metadata XML file just saved. This action will automatically populate the Single sign-on URL and Signing certificate fields. Click **Save**

![Untitled2.png](https://cdn.document360.io/efce33ac-4fef-4586-80ea-16e488013376/Images/Documentation/Untitled2%281%29.png)
4. Log out of the Splashtop Secure Workspace, and the SAML login button will show up, use the assigned OKTA user to login

### Step 4: OKTA SAML-SCIM setup

1. Enable SCIM Splashtop Secure Workspace IDP config page
  1. Create or edit the created IDP in Splashtop Secure Workspace **→ settings → Identity Providers**, check SCIM to enable this function (enable **Sync group automatically** to allow push group function sync group to Splashtop Secure Workspace automatically).
  2. When you check it, the system will display the Basic URL and API Token, which will be used in the next steps.
  3. Click **Save** to implement the change.  

![Untitled3.png](https://cdn.document360.io/efce33ac-4fef-4586-80ea-16e488013376/Images/Documentation/Untitled3.png)
2. In OKTA App config SCIM
  1. In the created Okta app, **Provisioning → Configure API Integration**
  2. Check **Enable API integration**
  3. Fill in the URL and token obtained in previous step.
  4. Then Test API Credentials → then Save
  5. Save after the Test is successful
  6. Go to the Provisioning page → To App
  7. Enable following: **Create Users, Update User Attributes, Deactivate Users** and **Save.**  

![image.png](https://cdn.document360.io/efce33ac-4fef-4586-80ea-16e488013376/Images/Documentation/image%2818%29.png)
3. Assignments
  1. Open the created App in OKTA and select Assignments.
  2. You can assign users to this App individually, or select an entire group to assign its internal users to this App, click the Assign button in the upper left corner, and select Assign to Groups to assign by group
4. Push Groups
  1. In **Push Groups** tab, click the **Push Groups** to select the groups you’s like to push to Splashtop Secure Workspace
  2. After the Push Status become **Active**, the push groups is done.

## OKTA OIDC setup

### Step 1: Accessing the Identity Providers Section

1. Log in to your Splashtop Secure Workspace admin account using your credentials.
2. Navigate to the **Settings** tab.
3. Click on the **Identity Providers** section.

### Step 2: Adding a New OIDC IDP

1. In the Identity Providers section, click on the **Add New** button.
2. Select **OIDC** from the available options.  

![image.png](https://cdn.document360.io/efce33ac-4fef-4586-80ea-16e488013376/Images/Documentation/image%2817%29.png)

### Step 3: Configuring the OIDC IDP

1. Enter the **Display Name** for the OIDC IDP.
2. Set the **Enabled** option to enable the OIDC IDP.
3. In the upcoming steps, we will utilize the **Redirect URL** located in the upper right corner of the page.
4. Open a new tab to log in to the **OKTA admin** portal to open **Applications** → **Browse App Catalog →** Search for **Splashtop Secure Workspace →** Choose **Splashtop Secure Workspace → Add Integration**
5. After add the **Application label** go to next page, then select **OpenID Connect**, fill in the **Redirect URL (OIDC)** we get in previous step, and change **Application username formate** to **Email** then click the **Done** button.
6. After the Application is created, go to **Sign On** tab, copy the **Client ID** and **Client secret** to fill in them the Splashtop Secure Workspace **Identity Providers** config page.
7. Go to **Assignments** → assign the people/groups you like to assign to access the Splashtop Secure Workspace.
8. For the **Authorization url** and **Token url**  you need to get them from the https://${your_okta_domain}/.well-known/openid-configuration
  1. To look for: `authorization_endpoint` and `token_endpoint`
  2. eg. https://dev-98112303-admin.okta.com/.well-known/openid-configuration
    1. authorization_endpoint → **Authorization url**：`https://dev-98112303.okta.com/oauth2/v1/authorize`
    2. token_endpoint →**Token url**：`https://dev-98112303.okta.com/oauth2/v1/token`
9. Now the OIDC configuration is done, log out of the Splashtop Secure Workspace, and the OIDC login button will show-up, use the assigned OKTA user to login

### Step 4: OKTA OIDC-SCIM setup

1. Enable SCIM Splashtop Secure Workspace IDP config page
  1. Create or edit the created IDP in Splashtop Secure Workspace **→ settings → Identity Providers**, check SCIM to enable this function (enable **Sync group automatically** to allow push group function sync group to Splashtop Secure Workspace automatically).
  2. When you check it, the system will display the Basic URL and API Token, which will be used in the next steps.
  3. Click **Save** to implement the change.
2. In OKTA App config SCIM
  1. In the created Okta app, **Provisioning → Configure API Integration**
  2. Check **Enable API integration**
  3. Fill in the URL and token obtained in previous step.
  4. Then Test API Credentials → then Save
3. Then come to the provisioning page, click edit, enable the functions: **Create Users, Update User Attributes, Deactivate Users** and then S**ave** ![Untitled5.png](https://cdn.document360.io/efce33ac-4fef-4586-80ea-16e488013376/Images/Documentation/Untitled5.png)
4. Assignments
  1. Open the created App in OKTA and select Assignments.
  2. You can assign users to this App individually, or select an entire group to assign its internal users to this App, click the Assign button in the upper left corner, and select Assign to Groups to assign by group
5. Push Groups
  1. In **Push Groups** tab, click the **Push Groups** to select the groups you’s like to push to Splashtop Secure Workspace, then click **Save**
  2. After the Push Status become **Active**, the push groups is done.