> This page is for Data Protection.

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.eon.io/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.eon.io/_mcp/server.

# Set Up SAML SSO for Okta

This article explains how to set up Eon's Okta integration from the Okta catalog.
After completing this process, users who are members of the groups you've mapped can log in to Eon using SAML SSO.

> **Note**
>
> If you've already configured SAML and want to adjust groups, skip to [Map SAML groups in Eon](#map-saml-groups-in-eon).

## Configure Okta SAML SSO

You'll find the

SAML SSO

page under **Access management** in your global management console in Eon.
Identity providers and their group mappings are both on this page.

### Supported Okta features

The integration uses Okta's **SP-initiated SSO** feature, which means your users sign in to Eon from Eon's login page rather than from the Eon tile in Okta.
Clicking the tile in Okta brings users to their Eon login page.

### Before you start

Before you start, make sure:

* You're an Okta administrator.

* You have the permissions in Eon mentioned at the top of this article.

* There's a role that has the exact permissions you want to grant to the group.
  If there isn't one, you can [create a custom role][manage-custom-roles].

[manage-custom-roles]: /data-protection/account-administration/access-management/roles-and-permissions/manage-custom-roles

#### Copy Eon's service provider details

In Eon, go to the

SAML SSO

global management page.
Click **Add Identity Provider**.
Once you have at least one identity provider, this button is a    icon in the header of the **Identity providers** panel.

The **Add identity provider** dialog lists Eon's service provider details, which you'll paste into Okta, each with a copy button.
Keep the dialog open because you'll need these values in the next step.

#### Configure the SAML integration in Okta

To get started, open Eon's listing in the Okta app catalog in a new tab:

Open Eon in the Okta catalog

1. Click **Add Integration**.
   Okta's account selection page is opened.

2. Choose your Okta organization and log in.

3. In the app's **General settings** page, fill in the form:

   ![Okta Add Eon.io page showing General Settings fields.](/_fern-img/b1dd26d81279ffe8ae49923d4fc6157b0f92c5c95b4cfc88390fe7656f289d8a.webp)

   1. In **Application label**, give a meaningful name, such as `Eon.io`.

   2. Copy Eon's service provider details from the **Add identity provider** dialog you left open in Eon:

      | Okta field     | Eon field                      |
      | -------------- | ------------------------------ |
      | **Eon Domain** | **Eon account domain**         |
      | **Entity ID**  | **Service provider entity ID** |

   3. In **Application Visibility**, leave **Do not display application icon to users** unselected.

4. Click **Done**.

The app is created and you're redirected to Okta's app information page.

#### Add user groups to the claim

Configure the app to send user group membership with the SAML assertion so Eon can map users to the correct roles.

1. In the **Sign On** tab, in the **Settings** section, click **Edit**.

2. In the **Configured SAML Attributes** section, set **groups** to **Matches regex** and type `.*` in the text box.

   > **Note**
   >
   > If too many groups are sent with the SAML assertion, the request can become malformed and cause login failures.
   > As a best practice, filter the groups sent to only those relevant to the Eon app.
   > For example, use a regex pattern like `^EON_.*` to send only groups that start with `EON_`.

3. Click **Save**.

#### Assign the Okta app to user groups

Assign the Eon app to user groups to control which users can access Eon through SAML SSO.

In the **Assignments** tab, click **Assign > Assign to Groups**.
Choose the groups you want to be able to access Eon.

#### Copy the SAML settings to Eon

Return to the **Add identity provider** dialog in Eon.

1. Give a meaningful **Display name**, such as `Okta`.
   You can't change it later, so pick a name you'll recognize.

2. Provide the corresponding SAML details from Okta.
   You can find these settings in the **Sign On** tab by expanding **More details**:

   | Eon field              | Okta field                           |
   | ---------------------- | ------------------------------------ |
   | **SSO URL**            | **Sign on URL**                      |
   | **Issuer URL**         | **Issuer**                           |
   | **SLO URL**            | **Sign out URL**                     |
   | **Public certificate** | Download the **Signing Certificate** |

   > **Important**
   >
   > Eon requires the entire contents of the certificate, including the `BEGIN CERTIFICATE` and `END CERTIFICATE` lines.
   > Copying the signing certificate directly from Okta omits these lines, so you'll need to download the certificate and copy its contents from the `.cert` file.

3. Click **Add Identity Provider**.

#### Map SAML groups in Eon

Although SAML SSO is now enabled on your Eon account, SAML users can't log in yet because they have no Eon access by default.
To grant access, you need to map your SAML groups in Eon.

Click **Add Group Mapping**.
The **New group mapping** dialog opens.

Set these options:

* **SAML identity provider**:
  Choose the Okta identity provider you just added.

* **Group ID**:
  Enter the group's ID your identity provider passes in the SAML assertion.
  This must be an exact match with the assertion.
  This is case-sensitive, so `eon viewers` and `Eon viewers` are different groups.

  > **Note**
  >
  > Okta uses the group's name as the group ID.

* **Label**: Optionally, give the group a display name so it's more recognizable in Eon.

Then choose the roles you want to assign to the group.
You can assign multiple roles.

Click **Create**.

> **Info**
>
> SAML configuration changes can take up to 15 minutes to take effect.

## Eon-initiated login

After setup and group mapping, your users can log in to Eon using their Okta credentials.
Let them know and share these directions with them:

![Eon login page with the Log In with SSO button highlighted above the email and password fields.](/_fern-img/fbf8289aa894170c213a2e80de801d7d78683b255143d77c0482e348f222603c.webp)

1. Go to your Eon domain's login page (for example, `https://your-company.console.eon.io/login`).

2. Click **Log In with SSO**.
   Enter your Okta credentials and sign in.

On successful login, you're redirected to the Eon console.

## See also

* [About SAML SSO]
* [Manage Custom Roles]

[About SAML SSO]: /data-protection/account-administration/access-management/saml-sso/about-saml-sso

[Manage Custom Roles]: /data-protection/account-administration/access-management/roles-and-permissions/manage-custom-roles