Okta IdP Single Sign-On (SSO) Setup - Technical Specifications Guide

  • Page Views 699

This is a guide for organizations using Okta to authenticate and enable Single Sign-On (SSO) with CITI Program. Our Okta integration is here. This requires a CITI Program Single Sign-On (SSO) enabled subscription. Note that SSO is a paid service with CITI Program. 

 

Contents

Supported Features

The Okta/CITI Program SAML integration currently supports the following features:

  • SP-initiated SSO
  • JIT (Just-In-Time) Provisioning

For more information on the listed features, visit the Okta Glossary.

Configuration Steps

  1. In Okta, select the Sign On tab for the CITI Program SAML app, go to Sign on methods > SAML 2.0 > Metadata details, and then locate and copy your Metadata URL.
    Share the Metadata URL with CITI Program Support in order to be enabled.

  2. The following SAML attributes below are required for CITI Program. More information here if you need to pass additional attributes.

    NAMEVALUE
    urn:oid:2.5.4.42user.givenname
    urn:oid:2.5.4.4user.surname
    urn:oid:0.9.2342.19200300.100.1.3user.mail
    urn:oid:1.3.6.1.4.1.5923.1.1.1.6user.userprincipalname
  3. CITI Program Support will provide you with your SSO URL.
  4. Create an Okta bookmark with the SSO URL. Since CITI Program is SP-initiated, the Okta-provided login link will not work. We then recommend hiding the application icon for users.

Notes

  • Make sure that you entered the correct value in the Subdomain field under the General tab. Using the wrong value will prevent you from authenticating via SAML to CITI Program.

​​​​

SP-initiated SSO

For testing the configuration:

  1. Use the SSO URL provided by CITI Program Support.
  2. Login with Okta.

Once your SSO link is live and published:

  1. Go to: https://www.citiprogram.org/portal
  2. Select your Organization.
  3. Login with Okta.

 

Contact the CITI Program for more information