Set up SSO with Okta

This article explains how to set up Single Sign-On (SSO) for Big Think+ with Okta using SAML 2.0.

This guide is for Okta administrators. When setup is complete, your users sign in to Big Think+ with their Okta accounts. Okta is the identity provider (IdP) and Big Think+ is the service provider (SP).

What do I need before I start?

• Okta administrator access with permission to create app integrations.
• Your Big Think+ organization permalink, provided by your Big Think+ Partner Services contact. Wherever this guide shows <permalink>, replace it with yours.
• The email domains your users sign in with (for example, yourcompany.com).

What values do I enter in Okta?

The ACS URL ends in /acs, not /metadata. You can confirm both values in the Big Think+ metadata at https://plus.bigthink.com/o/<permalink>/auth/saml/metadata: the ACS URL is the Location of the AssertionConsumerService entry and the Entity ID is the entityID value.

How do I set up SSO with Okta?

1. Create the Big Think+ app in Okta

1. In the Okta Admin Console, go to Applications > Applications and click Create App Integration.
2. Select SAML 2.0 and click Next.
3. On General Settings, enter Big Think+ as the app name. Optionally upload a Big Think+ logo (ask Partner Services for one). Click Next.
4. On Configure SAML, enter the Single sign-on URL and Audience URI from the table above. Leave Use this for Recipient URL and Destination URL checked.
5. Set Name ID format to EmailAddress and Application username to Email. Big Think+ identifies each user by this email address.
6. Attribute statements are optional. If you want first and last names in Big Think+ analytics, add attribute statements for them (for example, firstName mapped to user.firstName and lastName mapped to user.lastName) and tell Partner Services the names you used.
7. Click Next. On the feedback screen, indicate that this is an internal app you created, then click Finish.

2. Send your metadata and domains to Big Think+

1. Open the Sign On tab of the Big Think+ app and copy the Metadata URL. (If you only see a certificate list, use Actions > View IdP metadata and copy the address of the page that opens.)
2. Email your Partner Services contact (or partnerservices@bigthink.com) with:
   • The metadata URL. A URL is preferred over an XML file because Big Think+ can pick up changes from it.
   • The email domains your users sign in with. Big Think+ uses these to send users to Okta from the sign-in page.
   • The email address of your first Big Think+ admin. That person signs in once through SSO, and Big Think+ promotes them to admin.

3. Assign users

New Okta apps are not available to anyone until you assign them. On the Assignments tab, click Assign and choose Assign to People or Assign to Groups.

Okta assignment is the only gate. Anyone you assign gets a Big Think+ account the first time they sign in, so assign only the people or groups who are licensed for Big Think+.

4. Test the connection

After Partner Services confirms your metadata is loaded, test with an assigned user:

• From Okta (IdP-initiated): click the Big Think+ tile on the Okta End-User Dashboard. Big Think+ should open, signed in.
• From Big Think+ (SP-initiated): open https://plus.bigthink.com/o/<permalink> in a private browser window. You should be sent to Okta, then returned to Big Think+ signed in.

What happens when my signing certificate changes?

Okta signing certificates expire. Before you rotate or replace the certificate on the Big Think+ app, contact Partner Services so the change on both sides happens together. If you sent an XML file instead of a URL, send the new file.

What if something is not working?

See Troubleshooting SSO sign-in. Okta's own reference: Create SAML app integrations.

Back to Single Sign-On (SSO) / SAML 2.0 overview