This question came from a member of the Persona community, a team manager who was trying to configure use of Persona for their employees. This is useful for those who want to understand how to manage Okta single sign-on for multiple Persona instances with the same set of users or employees.
Question
How do I enable employees to access multiple Persona organizations configured with Okta single sign-on?
Answer
Thank you for your question. We can help with this one. As a prerequisite, you must have Okta single sign-on enabled for each Persona organization/instance that you want to configure access for.
Example setup
- These setup instructions use these references:
- Email: alex@domain.com
- Persona Organization One: First Acme Fintech
- Persona Organization Two: Second Acme Fintech
With this setup, the user with the email alex@domain.com can log in to two Persona Orgs with these emails:
| Organization Name | Login Email |
|---|---|
| First Persona Organization | alex@domain.com |
| Second Persona Organization | alex+secondacme@domain.com |
Configure Application username
-
With your Okta admin account, go to the Applications section of the Okta account of the email.
-
Because of the prerequisites, you should have an application with the name Second Persona Application that is set up with SSO. Click Second Persona Application > General.
-
Under the SAML Settings, click Edit to change the configuration.
-
Click Next to go to the Configuration SAML section.
-
Change the Application username to Custom.
Existing New Application username Email Custom -
In the custom rule field, enter this expression:
String.replace(user.login, "@{company_domain}.com", "+{desired_string}@{company_domain}.com")- For example, from the setup:
String.replace(user.login, "@domain.com", "+secondacme@domain.com")
-
Go to Attribute Statements. Update
user_emailto this value:Name Name format Value user_emailUnspecified String.replace(user.email, "@{company_domain}.com", "{desired_string}@{company_domain}.com") -
Save the updated changes.
-
To complete the provisioning, Alex (the employee or user that you set this up for) must do one of these options:
- Option 1 — Log in to each Persona Org through Okta Tiles.
- Option 2 — Log in to the two Persona Orgs with the Persona Organization Slug at least one time.
-
The setup is complete. Alex can now use each email to log in to the applicable Persona Organization.
This does not change the Okta username that the end user uses to log in to their Okta Dashboard. It also does not change the email address in other downstream applications that are connected to Okta.
This answer was reviewed by Justin Sayarath, a product manager at Persona. FAQs, unlike other articles, are written to provide Persona Community members more specific answers to common questions. While we periodically review responses and answers, please note when this FAQ was last updated as information may have changed since then.