Set up Okta for SSO

Set up Single Sign-On (SSO) integration between Okta and Private Cloud Director (PCD). You will configure an Okta SAML 2.0 application and connect it to your PCD deployment for seamless user authentication.

Only 5 active applications are allowed in Okta. Deactivate unused applications before creating new integrations.

Step 1: Create Okta SAML application

This step guides you through creating a new SAML 2.0 application integration in Okta.

  1. Log in to your Okta server and navigate to Applications. Verify you have fewer than 5 active applications. If needed, deactivate unused applications.
  2. Select Create App Integration.
  1. Select SAML 2.0 as the sign-on method.
  1. Select Next to proceed to the general settings.

Step 2: Configure SAML settings

Configure the basic SAML integration settings for your PCD deployment.

  1. On General Settings, enter a descriptive application name.
  2. Select Next to proceed to SAML configuration.
  1. In Configure SAML, enter the following required information:

Replace <FQDN>with your PCD environment without any regions. Use IDP1 for the default domain, or substitute your specific domain name for <DOMAIN_NAME> .
FieldDescription
Single sign-on URLhttps://<FQDN>/sso/<DOMAIN_NAME>/Shibboleth.sso/SAML2/POST Example: https://test-du-testbed-only-3950700.app.qa-pcd.platform9.com/sso/IDP1/Shibboleth.sso/SAML2/POST
Use this for Recipient URL and Destination URLSelect this checkbox
Audience URI (SP Entity ID)https://<FQDN>/keystone Example: https://test-du-testbed-only-3950700.app.qa-pcd.platform9.com/keystone
Default RelayStateLeave blank
Name ID formatEmailAddress
Application UsernameOkta Username
Update application username onCreate and update

Step 3: Set up attribute statements

Add attribute statements to pass user information from Okta to PCD .

  1. Optionally, you can choose to update the Attribute Statements by adding the following mappings.
NameName FormatValue
FirstNameUnspecifieduser.firstName
LastNameUnspecifieduser.lastName
EmailUnspecifieduser.email
  1. Select Next to continue.
  2. In Feedback, select Finish to complete the application setup.

You will be redirected to the application Sign On Settings, which displays the Issuer and Metadata URL needed for PCD configuration.

Step 4: Assign users to the application

Grant users access to the SAML application in Okta.

  1. Navigate to the Assignments tab in your application.
  2. Select Assign, then select Assign to People.
  3. Select the users to give access to PCD through SSO.
  4. Choose Assign to complete the user assignment.

The Okta configuration is now complete.

Step 5: Configure SSO in PCD

Connect your PCD deployment to the Okta SAML application.

  1. Log in to your PCD deployment using the DU FQDN for your target region.
  2. Navigate to Settings > Enterprise SSO.
  3. Select Enable SSO.
  1. Select Okta as your SSO Provider.
  2. Copy the Issuer from your Okta application Sign On and paste it in the Entity ID field.
  3. Copy the Metadata URL from your Okta application Sign On tab and paste it in the SAML Metadata URL field.
  4. Add the following XML configuration in the SSO Provider Attribute MAP field:
YAML
Copy
  1. Select Save to create the configuration.

You will see a confirmation message as SSO configuration saved.

Step 6: Create SAML groups and mappings

Set up SAML groups to manage user permissions and role assignments in PCD.

  1. Create a new SAML group with the following settings:
FieldValue
NameEnter a descriptive group name
DescriptionProvide a clear description
SAML Attribute Key for User's First NameFirstName
SAML Attribute Key for User's Last NameLastName
SAML Attribute Key for User's EmailEmail
  1. Add a group mapping with these configurations.
FieldValue
SAML Group AttributeEmail
CriteriaAny one of
SAML Group ValuesEnter email addresses that match user assignments in your Okta application (for example: name@platform9.com, nonadmin@platform9.com)
  1. Assign roles and tenants from Tenants & Roles, by configuring the following.
RoleDescription
AdminFull administrative access
SSU (Self-Service User)Limited self-service access
ReadOnlyView-only access
  1. Select Add group to complete the SAML group setup.

Step 7: Verify the SSO integration

Verify if your Okta SSO integration works correctly.

  1. Log out of your current PCD session.
  2. Navigate to your PCD environment URL to initiate a new login.
  3. The system redirects you to Okta for authentication.
  4. Enter your Okta credentials and complete any required multi-factor authentication (MFA).

Upon successful authentication, Okta redirects you back to PCD with the appropriate user permissions.

You have now successfully configured Okta SSO for PCD. Users can now access PCD using their Okta credentials with seamless single sign-on authentication.

Type to search, ESC to discard
Type to search, ESC to discard
Type to search, ESC to discard
  Last updated on Jul 22, 2025
ssologin
Related pages
Enterprise SSOSet up Microsoft Entra ID for SSO
On This Page
Set up Okta for SSOStep 1: Create Okta SAML applicationStep 2: Configure SAML settingsStep 3: Set up attribute statementsStep 4: Assign users to the applicationStep 5: Configure SSO in PCDStep 6: Create SAML groups and mappingsStep 7: Verify the SSO integration