# SAML-based single sign-on (SSO) with Okta for Persona Dashboard > You can enable SAML-based Single Sign-On (including Just-In-Time (JIT) provisioning with SAML) for the Persona Dashboard via Okta. Source: https://help.withpersona.com/articles/3A0ZoW5ozu1k17n7bOrVuE/ Section: Admin > Single sign-on (SSO) and Authentication > Using SSO and SCIM ## Overview You can enable SAML-based Single Sign-On (including Just-In-Time (JIT) provisioning with SAML) for the Persona Dashboard via Okta by following this guide. By default, users can choose to login through SAML or via email and password. SAML enforcement can be configured by navigating to **Organization > Authentication** for a user with Admin permissions. ## Retrieve your Organization Slug Log in to your Persona dashboard as a user with Admin permissions. 1. Navigate to **[Organization](https://app.withpersona.com/dashboard/organization) > General**. 2. Next to **Organization slug**, copy your Organization Slug. Make note of your Organization Slug. You'll need it in the next steps. The slug also appears under **Single sign-on** on the **Authentication** tab after SSO has been enabled. ## Add Persona to Okta 1. Log in to your Okta organization as a user with administrative privileges. Make sure to switch to the Admin Console with Classic UI. The new UI does not currently support SAML based integrations. 2. Click **Applications** in the menu bar. Then click **Add Application** and then **Create New App**. 3. In the Create a New Application Integration dialog box, leave Web as the platform and select SAML 2.0 as the protocol. Click **Create**. 4. On (1) General Settings, enter Persona as the name of the new Application. Click **Next**. 5. On (2) Configure SAML, enter the following for the fields. **General** - Single sign on URL: `https://withpersona.com/saml//acs` - Audience URI: `https://withpersona.com/saml//metadata` - Name ID Format: Unspecified - Application username: Email ℹ️ ORGANIZATION-SLUG comes from the first section (Retrieving your Organization Slug) **Attribute Statements** | Name | Name format | Value | | ------------ | ----------- | ---------------- | | `user_email` | Unspecified | `user.email` | | `name_first` | Unspecified | `user.firstName` | | `name_last` | Unspecified | `user.lastName` | 6. Click **Next** and then leave any feedback. 7. Get your Identity Provider metadata URL for Persona to integrate back with Okta. This can be found under the Sign On tab in the SAML 2.0 callout by clicking the Identity Provider metadata link. Copy the URL and keep it handy for the next steps. The format of the URL should look like `https://dev-12345.okta.com/app/abcdefg/sso/saml/metadata` ## Complete the Okta integration in Persona 1. Log in to your Persona dashboard as a user with Admin permissions 2. Navigate to **[Organization](https://app.withpersona.com/dashboard/organization) > Authentication**. 3. Under **Single sign-on**, click **Set up** (or **Manage** if SSO is already configured). 4. Enter in the Metadata URL you obtained from the last step in the Adding Persona to Okta section. 5. Click **Register provider** (or **Update provider** if you are changing an existing configuration). ℹ️ Set up SSO with the metadata URL rather than a static metadata XML file. Persona re-reads the URL, so when a new SAML signing certificate is activated in Okta, Persona picks it up automatically and your SSO keeps working without any changes on the Persona side. If done successfully, you should see a notification letting you know that your Okta integration has been set up. ## Logging in to Persona through Okta 1. To log in to Persona through Okta, first make sure that the user has been assigned to the Application in Okta. 2. The user should then see Persona in their Okta dashboard. By clicking Persona, they should automatically log in to their Persona dashboard. ## Renewing an expiring SAML SSO certificate SAML signing certificates expire. Persona monitors your certificate's expiration and will remind you before it lapses, but the replacement certificate has to be generated and activated in Okta and made available to Persona. If Persona already has your live Identity Provider metadata URL on file, we automatically pick up the renewed certificate once you've activated it in Okta, so no further action is needed on the Persona side. If your integration was set up with a static metadata XML file instead, you'll need to re-upload the updated metadata every time the certificate rotates. Switch it to the metadata URL to avoid that. ⚠️ You do not need to create a new Okta application. Reuse the existing application you set up for Persona login. Creating a new one is the most common way to break SSO. ### Generate a new certificate in Okta 1. Log in to your Okta organization as a user with administrative privileges. Switch to the Admin Console with Classic UI. 2. Go to **Applications** and open the existing application you use for Persona login. 3. Click the **Sign On** tab. ![Generate a new certificate in Okta](https://assets.withpersona.com/f_auto,q_auto/help-center/articles/admin/image-5.png '2192x1402') 4. Scroll to the **SAML Signing Certificates** section and click **Edit**. 5. Click **Generate New Certificate**. A new certificate row appears with a status of **Inactive**. ### Activate the new certificate ☝️ Leave your current certificate Active until the new one is activated and working. Keep a copy of your existing metadata XML so you can roll back if logins break. 1. In the SAML Signing Certificates table, find the newly generated (Inactive) certificate row. ![Activate Certificate in Okta SSO](https://assets.withpersona.com/f_auto,q_auto/help-center/articles/admin/image-6.png '1466x360') 2. In the **Actions** column, click **Activate**. Its status changes to **Active** and the previous certificate becomes Inactive. ![Activate Action for Certificate in Okta SAML SSO](https://assets.withpersona.com/f_auto,q_auto/help-center/articles/admin/image-7.png '1466x942') ### Refresh the metadata in Persona If Persona already has your live Identity Provider metadata URL, the renewed certificate is picked up automatically, so you can skip these steps. If your integration still uses a static metadata file, switch it to the URL now so future rotations need no action: 1. In Okta, copy your **Identity Provider metadata URL** from the **Sign On** tab (format: `https://dev-12345.okta.com/app/abcdefg/sso/saml/metadata`). 2. Log in to your Persona dashboard as a user with Admin permissions. 3. Navigate to **[Organization](https://app.withpersona.com/dashboard/organization) > Authentication**. 4. Under **Single sign-on**, click **Manage** (or **Set up**). 5. Enter the metadata URL and click **Update provider** (or **Register provider**). ## FAQs ### Does Persona support JIT provisioning via SAML? Yes, we support JIT provisioning for users. ### Is there an API for creating and disabling users? We currently don't have an API for creating/disabling users. ### Is it possible to send over the user's role in Persona as an attribute in the SAML assertion? At the moment, all new users will be set to an Organization's default role configured from within the dashboard. We do not currently support sending a user's role as an attribute, but if this is a high priority for your team please reach out to your Persona contact or Persona support to let us know about your need. ## Plans Explained ### SAML-based SSO with Okta by plan | | Startup Program | Essential Plan | Growth Plan | Enterprise Plan | | ------------------------ | --------------- | -------------- | ------------- | --------------- | | SAML-based SSO with Okta | Available | Available | Available | Available | | SCIM with Okta | Not Available | Not Available | Not Available | Available | [Learn more about pricing and plans](https://withpersona.com/pricing?utm_source=product&utm_medium=referral&utm_audience=a&utm_campaign=cm_gen_ds_hc-plan-table).