Skip to main content
This guide explains how to configure Okta Single Sign-On (SSO) so users can securely log in to ResolveAI. You’ll create a custom SAML application, configure user and group attributes, and share your setup details with your Resolve contact.
This setup must be completed by an Okta Administrator.

​
Features & Requirements

ResolveAI supports SAML 2.0-based SSO with Okta, including:
  • Just-In-Time (JIT) User Provisioning: User accounts are created on first login
  • Group-based access control via SAML attributes (optional)
Note: We do not currently support SCIM (System for Cross-domain Identity Management) for automated user/group provisioning and de-provisioning. To use ResolveAI with SAML SSO, you must have an Okta license that supports custom SAML app integrations: the ability to configure SAML assertions and attributes. This typically requires Okta Workforce Identity licenses at the Business or Enterprise tier. Please verify with your Okta admin to confirm availability in your plan.

​
1. Create a SAML App

  • Log in to your Okta Admin Dashboard (ex. yourcompany.okta.com)
  • Go to Applications -> Applications
  • Click Create App Integration
  • Select SAML 2.0 as the sign-on method and click Next
If you’re evaluating multiple vendors in Okta, create and label a separate SAML app for Resolve AI. Do not reuse another vendor’s SSO URL, metadata, application ID, or configuration task. Before testing, verify the app name and the configured callback URL belong to Resolve AI.If your organization has multiple Okta instances, confirm you are in the right one before creating the app.

​
2. Configure App Details

​
3. Configure SAML Settings

Before you save, confirm you are editing the Resolve AI SAML app, not another vendor’s, and that you are in the correct Okta tenant. The Audience URI must be exactly app0.resolve.ai — no https://, no trailing slash, no path, no fragment (#).The Single sign-on URL must be the Resolve-provided callback URL. If you’re running multiple vendor POCs, confirm the URL belongs to the Resolve AI app integration before saving.
  • Single sign-on URL: https://app0.resolve.ai/auth/saml/callback
  • Audience URI (SP Entity ID): app0.resolve.ai (copy exactly — no scheme, no trailing slash, no path, no fragment)
  • Default RelayState: leave blank
  • Name ID format: Unspecified
  • Application username: Okta username — this value must be the user’s primary email address. Okta username is usually the same as the user’s email; if your organization’s Okta usernames are not email addresses, select user.email instead.

​
4. Add Attribute Statements

Map the following attributes (names are case-sensitive):
  • email: user.email
  • firstName: user.firstName
  • lastName: user.lastName

​
5. Contact ResolveAI

In the Sign On tab, click View Setup Instructions and copy the following details:
  • Sign on URL
  • Sign out URL
  • Issuer (Entity ID)
  • Signing certificate
Share these with your Resolve contact to complete the connection.

​
6. Test the login

Once your Resolve contact confirms the connection, test before rolling out to users: Resolve AI supports both sign-in paths.
  1. Save the Okta app configuration.
  2. Assign a test user to the app.
  3. In an incognito or private browser window, sign in to app0.resolve.ai as the assigned test user.
  4. Confirm the user reaches Resolve AI.
  5. As the assigned test user, also click the Resolve AI tile in your Okta dashboard (IdP-initiated login) and confirm it reaches Resolve AI. Test both if your users will sign in from the Okta dashboard.
If the login fails, follow the troubleshooting steps below before contacting support.

​
Troubleshooting

Symptom: login fails even though the SAML fields look correct. Capture the SAML request from the browser (steps below) and compare the ACS and metadata URL it carries against the values in this guide. If you cannot read the encoded request, send it to your Resolve contact and we will decode it. A mismatch means the wrong Okta application or vendor configuration is in play — most often, the admin is editing a different vendor’s app or a different Okta instance. To capture the SAML request:
  1. Open your browser’s developer tools and go to the Network tab.
  2. Enable Preserve log and Disable cache.
  3. Retry the login.
  4. Find the SAML request in the network log and capture the full request URL. Share it with your Resolve contact.
The Okta System Log can lag. A missing log entry is not proof the login attempt didn’t happen — wait a few minutes and refresh before concluding an event is missing.

​
Optional: Group Attribute Mapping for RBAC

If you’re using Okta groups to control Resolve roles:
  1. In the Group Attribute Statements section:
    • Name: groups
    • Filter: define which groups to include (ex. resolve-admins)
  2. Contact Resolve to map group names to roles (ex. Admin, Member)
In the Assignments tab, you can assign which users or groups can access ResolveAI. Learn more about assigning users and groups to an Okta app and defining group attribute statements.