> ## Documentation Index
> Fetch the complete documentation index at: https://docs.resolve.ai/llms.txt
> Use this file to discover all available pages before exploring further.
# Okta
This guide explains how to configure Okta Single Sign-On (SSO) so users can securely log in to ResolveAI. You'll create a custom SAML application, configure user and group attributes, and share your setup details with your Resolve contact.
This setup must be completed by an Okta Administrator.
## Features & Requirements
ResolveAI supports SAML 2.0-based SSO with Okta, including:
* Just-In-Time (JIT) User Provisioning: User accounts are created on first login
* Group-based access control via SAML attributes (optional)
Note: We do not currently support SCIM (System for Cross-domain Identity Management) for automated user/group provisioning and de-provisioning.
To use ResolveAI with SAML SSO, you must have an Okta license that supports custom SAML app integrations: the ability to configure SAML assertions and attributes. This typically requires Okta Workforce Identity licenses at the Business or Enterprise tier. Please verify with your Okta admin to confirm availability in your plan.
***
## 1. Create a SAML App
* Log in to your Okta Admin Dashboard (ex. `yourcompany.okta.com`)
* Go to **Applications -> Applications**
* Click **Create App Integration**
* Select **SAML 2.0** as the sign-on method and click **Next**
If you're evaluating multiple vendors in Okta, create and label a **separate SAML app for Resolve AI**. Do not reuse another vendor's SSO URL, metadata, application ID, or configuration task. Before testing, verify the app name and the configured callback URL belong to Resolve AI.
If your organization has multiple Okta instances, confirm you are in the right one before creating the app.
## 2. Configure App Details
* **App Name**: ResolveAI
* [Download the ResolveAI logo](/images/resolveai-logo.png) and add it in **App logo**
* Click **Next** to continue
## 3. Configure SAML Settings
Before you save, confirm you are editing the **Resolve AI** SAML app, not another vendor's, and that you are in the correct Okta tenant. The Audience URI must be exactly `app0.resolve.ai` — no `https://`, no trailing slash, no path, no fragment (`#`).
The **Single sign-on URL** must be the Resolve-provided callback URL. If you're running multiple vendor POCs, confirm the URL belongs to the Resolve AI app integration before saving.
* **Single sign-on URL**: `https://app0.resolve.ai/auth/saml/callback`
* **Audience URI (SP Entity ID)**: `app0.resolve.ai` (copy exactly — no scheme, no trailing slash, no path, no fragment)
* **Default RelayState**: leave blank
* **Name ID format**: `Unspecified`
* **Application username**: `Okta username` — this value must be the user's primary email address. Okta username is usually the same as the user's email; if your organization's Okta usernames are not email addresses, select `user.email` instead.
## 4. Add Attribute Statements
Map the following attributes (names are case-sensitive):
* `email`: `user.email`
* `firstName`: `user.firstName`
* `lastName`: `user.lastName`
## 5. Contact ResolveAI
In the **Sign On** tab, click **View Setup Instructions** and copy the following details:
* Sign on URL
* Sign out URL
* Issuer (Entity ID)
* Signing certificate
Share these with your Resolve contact to complete the connection.
## 6. Test the login
Once your Resolve contact confirms the connection, test before rolling out to users:
Resolve AI supports both sign-in paths.
1. Save the Okta app configuration.
2. Assign a test user to the app.
3. In an incognito or private browser window, sign in to [app0.resolve.ai](https://app0.resolve.ai/) as the assigned test user.
4. Confirm the user reaches Resolve AI.
5. As the assigned test user, also click the Resolve AI tile in your Okta dashboard (IdP-initiated login) and confirm it reaches Resolve AI. Test both if your users will sign in from the Okta dashboard.
If the login fails, follow the troubleshooting steps below before contacting support.
***
## Troubleshooting
**Symptom: login fails even though the SAML fields look correct.**
Capture the SAML request from the browser (steps below) and compare the ACS and metadata URL it carries against the values in this guide. If you cannot read the encoded request, send it to your Resolve contact and we will decode it. A mismatch means the wrong Okta application or vendor configuration is in play — most often, the admin is editing a different vendor's app or a different Okta instance.
To capture the SAML request:
1. Open your browser's developer tools and go to the **Network** tab.
2. Enable **Preserve log** and **Disable cache**.
3. Retry the login.
4. Find the `SAML` request in the network log and capture the full request URL. Share it with your Resolve contact.
The Okta System Log can lag. A missing log entry is not proof the login attempt didn't happen — wait a few minutes and refresh before concluding an event is missing.
***
## Optional: Group Attribute Mapping for RBAC
If you're using Okta groups to control Resolve roles:
1. In the **Group Attribute Statements** section:
* **Name**: `groups`
* **Filter**: define which groups to include (ex. `resolve-admins`)
2. Contact Resolve to map group names to roles (ex. Admin, Member)
In the **Assignments** tab, you can assign which users or groups can access ResolveAI. Learn more about [assigning users and groups to an Okta app](https://help.okta.com/en-us/content/topics/users-groups-profiles/usgp-assign-app-group.htm#:~:text=Click%20the%20app%20name%20and,dialog%20box%20if%20it%20appears.) and [defining group attribute statements.](https://help.okta.com/oie/en-us/content/topics/apps/define-group-attribute-statements.htm)
