DX supports IdP- and SP-initiated Okta SAML 2.0 authentication, as well as SCIM directory sync.

Setting up single sign-on

Step 1

Navigate to the SAML SSO admin settings in DX to obtain:

Single Sign-On URL (ACS URL)
Audience URI (SP Entity ID)
DX icon

Step 2

From the Okta admin portal, create a new SAML 2.0 app integration.

Step 3

In the "General Settings" step, enter "DX" as the App name and upload the DX application icon.

Step 4

In the "Configure SAML" step, enter the single sign-on URL and Audience URI from step one. In addition, select EmailAddress as your Name ID format.

Step 5

In the final step, mark your integration as an internal app and then enter your Metadata URL here. Once entered, click update to apply the changes. You may opt to only allow authentication through Okta or still allow other forms of password-less authentication and single sign-on.

Setting up SCIM

User metadata such as manager, start date, and GitHub/GitLab usernames can be imported via Okta SCIM. To enable this, please contact your DX Account Representative.

Step 1 - Get a user data backup

Before getting started, we highly recommend exporting your current user data in case Directory Sync is mis-configured and updates user attributes incorrectly. To export your user data, go to the User CSV import page and click "Export CSV" in the upper right-hand corner.

Step 2 - Create the Okta App

1. Go to the Directory Sync settings page in DX, and click "Enable". This will take you to the WorkOS portal. From there, choose "Okta" as your directory provider and follow the step-by-step instructions to create your Okta App for DX.

Step 3 - Map attributes

When you get to the "Set up Attribute Mapping" step, you will need to configure the Okta App's profile with custom attributes.

1. There are some default attributes that should be left as-is. The following attributes should be left unedited so DX can correctly identify users via email and keep user names up-to-date.

2. To sync start dates, manager emails, GitHub usernames, and GitLab usernames, create custom attributes by clicking "Go to Profile Editor" from the "Provisioning" tab in the Okta App.

3. From the Profile Editor, click "+ Add Attribute".

Attribute mapping will not work unless these requirements are met:

"External namespace" must be set to urn:ietf:params:scim:schemas:core:2.0:User to adhere to SCIM conventions.
Provide the "External name" value to DX for mapping, not the "Variable name" value (although these can be the same).
Start dates must be formatted as YYYY-MM-DD or YYYY/MM/DD.

4. To sync custom user attributes, prefix the "External name" value with "tag_". In the example below, DX would create and sync a new user tag called "Seniority". Use underscores to denote more spaces (e.g. tag_Shirt_Size will become "Shirt Size" in DX).

5. Once your attributes are added, click "Mappings" from the Profile Editor to configure how the values are populated. After this, you can continue through the rest of the WorkOS steps.

Step 4 - Enable provisioning actions

Currently, user provisioning is not supported - DX only updates existing user attributes. At this point, your Okta App's Attribute Mappings should look something like this.

Step 5 - Complete setup

Follow the rest of the step-by-step instructions to complete the directory sync setup. When you are done, you should see the directory sync marked as connected in DX. The directory sync runs automatically each night. If you'd like to run an immediate directory sync after initial setup, please contact support.

Troubleshooting

I'm seeing "No directory users received"

This indicates that there are no groups or users assigned to the Okta app. Go to the "Assignments" tab in Okta and add a group or set of users you want to sync with DX.

Custom field is not syncing

If a custom field is not syncing, check that the Okta field has its External namespace set to urn:ietf:params:scim:schemas:core:2.0:User. Once the field configuration is updated, click the "Force sync" button within Okta.