Set up SSO with Okta

This guide connects Backvera to Okta with SAML single sign-on. You need admin access to both your Backvera workspace and Okta. Open the Backvera SSO wizard first (Settings > SSO) and keep it open – you will copy values between the two tabs. For the full Backvera side, see Set up SSO (SAML).

1. Create the SAML app in Okta

In the Okta Admin Console, go to Applications > Applications and click Create App Integration.
Choose SAML 2.0, then Next.
Name it Backvera and continue.

2. Enter Backvera’s details in Okta

On the SAML settings screen, set:

Single sign-on URL = Backvera’s ACS (Reply) URL (leave “Use this for Recipient and Destination URL” checked).
Audience URI (SP Entity ID) = Backvera’s SP Entity ID.
Name ID format = EmailAddress, and Application username = Email.
(Optional) Add a Group Attribute Statement named groups so Backvera can map your Okta groups to roles.

3. Copy Okta’s details into Backvera

Finish the app, open its Sign On tab and choose View SAML setup instructions (or download the IdP metadata), to get:

IdP SSO URL = Okta’s Identity Provider Single Sign-On URL.
IdP Entity ID = Okta’s Identity Provider Issuer.
X.509 certificate = the signing certificate Okta provides.

4. Map groups and enable

Back in the Backvera SSO wizard, paste the three values above. Then, in Group mappings, add a mapping for each group: type the IdP group name (an exact, case-sensitive match to your group claim) and pick the Backvera role to grant – Admin, Global view, or Project (admin or view per project). The roles are a pick-list, so there is nothing to guess. Save and enable, then assign the app to the right users or groups in Okta.

5. Sign in

Members sign in from the Sign in with SSO page by entering your workspace slug, then authenticate with your identity provider. A successful sign-in lands them in your workspace with the role you mapped. If sign-in is rejected, double-check the X.509 certificate, that Name ID is the user’s email, and that your group names match the mappings exactly.

Still need help? Email our team at [email protected].