Skip to main content

Configure SAML SSO with Okta

This guide configures Okta as the SAML Identity Provider (IdP) and VeloDB Cloud as the Service Provider (SP) for one VeloDB Cloud organization.

Prerequisites​

Before you begin, make sure that:

  • Your VeloDB Cloud organization uses the Premium plan.
  • You are an Organization Admin in VeloDB Cloud.
  • You can create and assign applications in Okta.
  • You can create a DNS TXT record for your corporate email domain.
  • You have an Okta user or group to assign to the VeloDB Cloud application.
  • You have configured any required MFA and sign-on policies in Okta.

Keep an active Organization Admin session open while you configure and test SSO.

Start SAML setup in VeloDB Cloud​

  1. Sign in to VeloDB Cloud as an Organization Admin.

  2. Click your profile area in the bottom-left corner of the console to open the account menu, then select Authentication.

  3. Turn on SAML Single Sign-on.

  4. In Add Application, copy the following values:

    • Single Sign-On URL
    • Service Provider Entity ID

Keep this page open while you configure Okta.

Create the Okta application​

  1. Sign in to the Okta Admin Console.

  2. Go to Applications → Applications.

  3. Select Create App Integration.

  4. Select SAML 2.0, and then select Next.

  5. Enter an application name, such as VeloDB Cloud, and then select Next.

  6. Configure the SAML settings:

    Okta fieldValue
    Single sign-on URLThe VeloDB Cloud Single Sign-On URL
    Audience URI (SP Entity ID)The VeloDB Cloud Service Provider Entity ID
    Default RelayStateLeave blank
    Name ID formatEmailAddress
    Application usernameEmail

  7. If Okta displays Use this for Recipient URL and Destination URL, enable it.

  8. Add the following attribute statement:

    NameName formatValue
    emailBasicuser.email

  9. Select Next, complete the Okta feedback form, and select Finish.

  10. On the Assignments tab, assign the users or groups that can access VeloDB Cloud.

For more information, see Create SAML app integrations in the Okta documentation.

Import Okta metadata​

  1. In the Okta application, open the Sign On tab.
  2. Locate the active SAML signing certificate and copy the Identity Provider metadata URL. Depending on the Okta interface, this action may be labeled Copy metadata URL or View IdP metadata.
  3. Return to VeloDB Cloud and continue to Configure Identity Provider.
  4. Paste the Okta metadata URL into Metadata URL.
  5. Select Verify.
  6. Confirm that VeloDB Cloud displays the imported IdP SSO URL and certificate.

The metadata URL must be publicly accessible over HTTPS.

Verify a domain and configure provisioning​

  1. Continue to Verify Domain.
  2. Select Add Domain, and enter your corporate email domain without @.
  3. At your DNS provider, create a TXT record using the TXT Record Name and Record Value displayed by VeloDB Cloud.
  4. Wait for the DNS change to propagate, and then select Verify for the domain.
  5. Select the Default Role assigned to users created through JIT provisioning.
  6. Select a JIT Provisioning Policy.
  7. Select Continue.

For details about the provisioning policies, see JIT provisioning.

Test and enable SSO​

  1. In Test SSO Login, select Test SSO Login.
  2. Authenticate with an Okta account assigned to the application.
  3. Confirm that VeloDB Cloud reports SSO Test Successful.
  4. Continue to Enable SSO, select Enable SSO, and complete the setup.

Enforce SSO​

Before you enforce SSO, an active Organization Admin must complete a regular SAML sign-in:

  1. Sign out of VeloDB Cloud.
  2. Start a new sign-in at https://www.velodb.cloud using the Organization Admin's email address.
  3. Authenticate through Okta and confirm that the administrator can access the organization.
  4. Return to Authentication and open the SAML SSO configuration.
  5. Select Configure next to Enable SSO, choose Enforce SSO, and confirm the change.

Do not use the Okta application tile to initiate sign-in. VeloDB Cloud supports Service Provider-initiated sign-in only.

When SSO is enabled but not enforced, the email sign-in page remains available for password or verification-code sign-in.

Removing a user's Okta assignment does not remove an existing VeloDB Cloud organization membership. When you offboard a member, remove the member separately on the VeloDB Cloud Members page.