Okta SSO Setup (SAML 2.0)
This guide walks you through configuring Okta as your identity provider for Ledly using SAML 2.0.
Okta SSO requires an Okta account with administrative access and a Ledly Enterprise plan ($1,999/mo).
Prerequisites
- Okta Administrator access
- Ledly organization administrator access
- Ledly Enterprise plan ($1,999/mo)
Configuration Values
You’ll need these Ledly values when configuring Okta:
| Setting | Value |
|---|---|
| Single sign-on URL (ACS URL) | https://ledlyv2-production.up.railway.app/api/sso/okta/callback |
| Audience URI (SP Entity ID) | https://ledlyv2-production.up.railway.app |
| Name ID format | EmailAddress |
Step 1: Create Okta Application
Log in to Okta Admin Console
Navigate to your Okta Admin Console at https://your-domain.okta.com/admin
Create a new application
- Go to Applications → Applications in the sidebar
- Click Create App Integration
- Select SAML 2.0 as the Sign-in method
- Click Next
Configure General Settings
| Field | Value |
|---|---|
| App name | Ledly |
| App logo | (Optional) Upload Ledly logo |
| App visibility | Configure as needed |
Click Next to continue.
Step 2: Configure SAML Settings
SAML Settings
Enter the following values:
| Field | Value |
|---|---|
| Single sign-on URL | https://ledlyv2-production.up.railway.app/api/sso/okta/callback |
| Recipient URL | Same as above (or leave “Use this for Recipient URL” checked) |
| Destination URL | Same as above (or leave “Use this for Destination URL” checked) |
| Audience URI (SP Entity ID) | https://ledlyv2-production.up.railway.app |
| Default RelayState | Leave empty |
| Name ID format | EmailAddress |
| Application username | Email |
Attribute Statements
Add these attribute statements to pass user information to Ledly:
| Name | Name format | Value |
|---|---|---|
email | Unspecified | user.email |
firstName | Unspecified | user.firstName |
lastName | Unspecified | user.lastName |
Group Attribute Statements (Optional)
If you want to pass group membership:
| Name | Name format | Filter |
|---|---|---|
groups | Unspecified | Matches regex .* (or filter specific groups) |
Click Next to continue.
Step 3: Complete Okta Setup
Feedback (Optional)
Select “I’m an Okta customer adding an internal app” or your appropriate option.
Click Finish to create the application.
Get SAML Configuration Values
After creating the app, you need to get the configuration values for Ledly:
- Click on your new Ledly application
- Go to the Sign On tab
- Scroll down to SAML Signing Certificates
- Click View SAML setup instructions (or click Actions → View IdP metadata)
You’ll need these values from the setup instructions:
| Value | Description |
|---|---|
| Identity Provider Single Sign-On URL | The URL Ledly will redirect users to |
| Identity Provider Issuer | Unique identifier for your Okta org |
| X.509 Certificate | Certificate to validate SAML assertions |
Download the Certificate
- In the SAML Signing Certificates section
- Find the active certificate (status: Active)
- Click Actions → Download certificate
- Keep this file - you’ll upload it to Ledly
Keep your X.509 certificate secure. This certificate is used to verify that authentication requests genuinely come from your Okta organization.
Step 4: Assign Users
Before users can sign in, you need to assign them to the application:
Navigate to Assignments
- In your Ledly application, click the Assignments tab
Assign Users or Groups
For individual users:
- Click Assign → Assign to People
- Find and select the users who need access
- Click Assign for each user
- Click Done
For groups (recommended):
- Click Assign → Assign to Groups
- Select the groups (e.g., “All Employees”, “Marketing Team”)
- Click Assign for each group
- Click Done
Users must be assigned to the Ledly application in Okta before they can sign in via SSO.
Step 5: Configure Ledly
Now configure Ledly to use your Okta identity provider:
Navigate to SSO Settings
- Log in to Ledly at app.ledly.io
- Go to Settings → SSO
Select Okta
Select Okta (SAML 2.0) as your identity provider.
Enter Configuration Values
Enter the values you collected from Okta:
| Field | Value |
|---|---|
| Issuer URL | Your Identity Provider Issuer from Okta |
| SSO URL | Your Identity Provider Single Sign-On URL |
| IdP Certificate | Paste the X.509 certificate content or upload the file |
Configure SSO Options
| Option | Recommended Setting |
|---|---|
| Auto-provision users | Enabled - Creates accounts for new SSO users |
| Default role | Member - New users start with member permissions |
| Allow password login | Your choice - Enable for fallback access |
Save Configuration
Click Save to apply the SSO configuration.
Step 6: Test SSO
Test with an Admin Account First
- Open an incognito/private browser window
- Navigate to your Ledly login page
- Click Sign in with SSO or enter your email
- Verify you’re redirected to Okta
- Sign in with your Okta credentials
- Confirm you’re redirected back to Ledly and logged in
Verify User Attributes
After logging in via SSO:
- Go to Settings → Profile
- Verify your name and email were populated correctly
Test JIT Provisioning (Optional)
- Assign a test user in Okta who doesn’t have a Ledly account
- Have them sign in via SSO
- Verify their account was automatically created
Configuration Reference
SAML URLs
| URL Type | URL |
|---|---|
| ACS URL (Assertion Consumer Service) | https://ledlyv2-production.up.railway.app/api/sso/okta/callback |
| SP Entity ID | https://ledlyv2-production.up.railway.app |
| SP Metadata URL | Contact support for SP metadata XML |
Supported SAML Features
| Feature | Supported |
|---|---|
| SP-initiated SSO | Yes |
| IdP-initiated SSO | Yes |
| Signed assertions | Required |
| Encrypted assertions | Optional |
| Single Logout (SLO) | Coming soon |
Troubleshooting
”SAML Response Invalid” Error
Possible causes:
- Clock skew between Okta and Ledly servers
- Expired or wrong certificate configured
Solutions:
- Ensure your IdP certificate in Ledly matches the active certificate in Okta
- Check that the certificate hasn’t expired
- Verify the Issuer URL matches exactly
”User Not Found” Error
Possible causes:
- User not assigned to the application in Okta
- JIT provisioning is disabled
Solutions:
- Verify the user is assigned to the Ledly app in Okta
- Enable “Auto-provision users” in Ledly SSO settings
”Audience Mismatch” Error
Possible causes:
- SP Entity ID doesn’t match
Solution: Verify the Audience URI in Okta is exactly:
https://ledlyv2-production.up.railway.app“Invalid ACS URL” Error
Possible causes:
- Callback URL mismatch
Solution: Verify the Single sign-on URL in Okta is exactly:
https://ledlyv2-production.up.railway.app/api/sso/okta/callbackCertificate Expiration
Okta certificates typically expire after 5 years. When a certificate expires:
- In Okta, generate a new certificate under SAML Signing Certificates
- Download the new certificate
- Update the certificate in Ledly Settings → SSO
- Test the connection before deactivating the old certificate
Revoking SSO Access
Remove User Access
To remove a specific user’s SSO access:
- In Okta Admin, go to Applications → Ledly
- Click Assignments
- Find the user and click X to unassign
Disable SSO Integration
To disable SSO for your entire organization:
- In Ledly, go to Settings → SSO
- Toggle off the SSO configuration or select “None” as provider
- Users will need to sign in with email/password
Support
If you need help with Okta SSO setup:
- Ledly Support: [email protected]
- Okta Documentation: help.okta.com
When contacting support, include:
- Your Ledly organization ID
- Any error messages displayed
- Screenshots of your Okta configuration (redact sensitive values)