# Configure SAML 2.0 integration for Okta

This section contains Okta-specific steps for configuring the SAML 2.0 integration as part of the broader [end-to-end authentication via SAML 2.0 tutorial](../saml-getting-started/index.md).

If you received a Foundry setup link to configure your initial SAML integration, skip to the next step. Otherwise, you can add a new SAML provider:

1. Go to the **Authentication** tab in Control Panel.
2. Select **Add provider**, enter a name (for example, `My Okta SAML`), and select **Create**.
3. In the **SAML** section, configure the SAML integration metadata and other values.

![SAML](../../../assets/9804df614ede872b1509fc4fca377efa0507c1d597d6d200d2335263cdc68d62.webp)

In Okta, create a SAML app integration by following [these instructions ↗](https://help.okta.com/en/prod/Content/Topics/Apps/Apps_App_Integration_Wizard_SAML.htm).

## SAML integration metadata

Copy the following from the Foundry Control Panel (as shown on the left) to use in the **Edit SAML Integration** page for Okta (as shown on the right):

| Foundry      | Okta |
| ----------- | ----------- |
| Assertion consumer service (ACS) URL | Single sign on URL |
| Entity ID | Audience URI (SP Entity ID) |

![SAML integration metadata](../../../assets/8f856d6c76bbd2edf8e6869a31603c9ed0687bc71988290334385c8683973785.webp)

## Attribute mapping

Okta does not define standard SAML attributes that can be used without further configuration beyond `NameID`. Attributes need to be defined in Okta first before they can be mapped in Foundry.

In Okta, declare the following attribute statements:

| Name      | Name format |  Value         |
|-----------|-------------|----------------|
| firstName | Basic       | user.firstName |
| lastName  | Basic       | user.lastName  |
| email     | Basic       | user.email     |

You can define the following mappings for user attributes in **Attribute mapping**. If using a Foundry setup link, Okta attribute mappings will be pre-filled.

* **ID:** `NameID`
* **Username:** `NameID` (alternatively, `email`)
* **Email:** `email`
* **First name:** `firstName`
* **Last name:** `lastName`

You can also define attribute mappings to mirror your existing Okta groups in Foundry. Define one or more group attribute statements in Okta and map them in **Group attribute mapping**.

![Attribute mapping](../../../assets/74cf896784f998b54899b78d50716fa059914bac24a94a6ac406ebc825384d32.webp)

## Identity provider metadata

In Okta, finish the creation of the SAML app integration then navigate to the **Sign on** tab to retrieve your identity provider’s metadata in an XML file under **Identity provider metadata**. Upload this to Foundry in the **Identity provider metadata** section.

![Identity provider metadata](../../../assets/ec13fbb6a0b3ac59ec0f81889def252ed3d8e00d13ed1d92f31322b8015e1ace.webp)

## Finish and save

In Foundry, add email domains associated with this SAML 2.0 integration under **Email domains**.

Finish by saving your SAML 2.0 integration and [move on to multi-factor authentication](../multi-factor-auth/index.md).