> ## Documentation Index
> Fetch the complete documentation index at: https://www.truefoundry.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Setting up External Auth with SAML OKTA

> Configure SAML v2 with Okta as an identity provider for external authentication with TrueFoundry.

## Configure SAML v2 for OKTA

This documentation will guide you in configuring SAML v2 IdP for OKTA. In this case, TrueFoundry will act as Service Provider (SP) to OKTA (IdP).

## Create an Application in OKTA

1. Log in into your Okta Admin Console navigate to `Applications`.
2. At the top of the screen click on `Create App Integration`.
3. In sign-in Method choose `SAML 2.0`.

<Frame caption="">
  <img src="https://mintcdn.com/truefoundry/bQq-Vzaj8rdD0TUQ/images/Screenshot-2025-12-17-at-4.38.04-PM.png?fit=max&auto=format&n=bQq-Vzaj8rdD0TUQ&q=85&s=b5c9ca1170d64e8a325e5f7d509770b2" width="1926" height="1114" data-path="images/Screenshot-2025-12-17-at-4.38.04-PM.png" />
</Frame>

4. Click `Next`
5. Name the application
6. Choose App Logo (Optional).

<Frame caption="">
  <img src="https://mintcdn.com/truefoundry/bQq-Vzaj8rdD0TUQ/images/Screenshot-2025-12-17-at-5.03.23-PM.png?fit=max&auto=format&n=bQq-Vzaj8rdD0TUQ&q=85&s=df60d0c41c9b42559867730e783e0ca8" width="2064" height="1092" data-path="images/Screenshot-2025-12-17-at-5.03.23-PM.png" />
</Frame>

7. Click `Next`

## Configure Your OKTA Application

* **Single Sign-on URL**: This is ACS endpoint which can be obtained from truefoundry.

```
    <control-plane-url>/api/svc/v1/saml/acs
```

* **Default RelayState**: This is endpoint where user will be redirected after being authenticated. This is generally control plane URL.

```
     <control-plane-url>/deployments?tab=services
```

<Frame caption="">
  <img src="https://mintcdn.com/truefoundry/bQq-Vzaj8rdD0TUQ/images/Screenshot-2025-12-22-at-3.32.39-PM.png?fit=max&auto=format&n=bQq-Vzaj8rdD0TUQ&q=85&s=84bcfc492f040f131fe689ab27822d92" width="2216" height="1592" data-path="images/Screenshot-2025-12-22-at-3.32.39-PM.png" />
</Frame>

<Frame caption="">
  <img src="https://mintcdn.com/truefoundry/bQq-Vzaj8rdD0TUQ/images/Screenshot-2025-12-17-at-5.23.34-PM.png?fit=max&auto=format&n=bQq-Vzaj8rdD0TUQ&q=85&s=7964f777c963fb04aa572ddc0a6b46b0" width="2166" height="964" data-path="images/Screenshot-2025-12-17-at-5.23.34-PM.png" />
</Frame>

* **Attributes Mapping**: Go to Sign on tab of your application and navigate to Attributes statements Section to add Attributes Mapping as shown below.

<Frame caption="">
  <img src="https://mintcdn.com/truefoundry/nMqDkzMKA7z8A6du/images/docs/Screenshot-2026-01-29-attribute-saml-okta.png?fit=max&auto=format&n=nMqDkzMKA7z8A6du&q=85&s=671f4232d676851bfa98f255950e470a" width="1470" height="950" data-path="images/docs/Screenshot-2026-01-29-attribute-saml-okta.png" />
</Frame>

## Integrate with TrueFoundry

To integrate Okta with TrueFoundry, Add the following configuration to env Variables
In Okta Application navigate to Sign on tab and click on `view SAML setup instructions`

* **OAUTH\_PROVIDER\_TYPE** : `EXTERNAL_SAML`

* **EXTERNAL\_SAML\_IDP\_ENDPOINT**: This value can be obtained from your Okta Application as demonstrated below. You will want to copy the Identity Provider Single Sign-On URL value from Okta into this field.

<Frame caption="">
  <img src="https://mintcdn.com/truefoundry/bQq-Vzaj8rdD0TUQ/images/Screenshot-2025-12-17-at-5.28.14-PM.png?fit=max&auto=format&n=bQq-Vzaj8rdD0TUQ&q=85&s=afb25ab23017f016a15e49edfe1ee7b0" width="2332" height="1528" data-path="images/Screenshot-2025-12-17-at-5.28.14-PM.png" />
</Frame>

* **EXTERNAL\_SAML\_CERTIFICATE**: From the overview of your SAML setup instruction in Okta, you should find a Certificate. Encode the the Certificate by Base64 Encoder and set it here.

* **EXTERNAL\_SAML\_ACCESS\_TOKEN\_EXPIRY\_SECONDS**: This is duration of access token that will be asigned to user, so keep it as required.

***