Loading...
Skip to main content

Okta SSO Integration

Set up Single Sign-On (SSO) and user provisioning with Okta and Courier.

Prerequisites​

  • Admin access to your Okta account
  • The following from Courier Support:
    • Single Sign-On (SSO) URL
    • Audience URI (SP Entity ID)
    • SCIM Endpoint URL and Bearer Token (if using provisioning)
    • (optional) Bookmark URL

Configure SAML SSO​

Create the Integration​

  1. Navigate to Applications → Applications in Okta
  2. Click Create App Integration
  3. Configure basic settings:
    • Sign-in method: Select SAML 2.0 and click Next
    • App name: Enter Courier
    • Logo: Courier Logo

Configure SAML Settings​

  1. Enter the credentials:
    • Single Sign-On (SSO) URL: [from Courier Support]
    • Audience URI (SP Entity ID): [from Courier Support]
  2. Add these Attribute Statements:
    • Name: id
      Format: Unspecified
      Value: user.id
    • Name: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress
      Format: Unspecified
      Value: user.email
  3. Complete setup:
    • Select I'm an Okta customer adding an internal app
    • Click Finish
    • In the Sign On tab, find the Metadata URL and click Copy
    • Send the Metadata URL to Courier Support

After Courier receives the metadata URL, we will configure the SSO integration on our end within 24 hours.

note

Remember to assign users to the app in Okta's Assignments tab.

Configure User Provisioning (SCIM)​

info

SCIM provisioning automates user management between Okta and Courier.

Set Up SCIM Connection​

  1. From your Courier App in Okta:
    • Select the Provisioning tab
    • Click Edit
  2. Enter SCIM settings:
    • SCIM connector base URL: [from Courier Support]
    • Unique identifier field: userName
    • Authentication Mode: HTTP Header
    • Bearer token: [from Courier Support]
  3. Enable provisioning features:
    • Push New Users
    • Push Profile Updates

Enable User Management​

  1. In the To App section (refresh if not visible):

    • Click Edit
    • Enable:
      • Create Users
      • Update User Attributes
      • Deactivate Users

  2. Configure user roles:

    • Navigate to Directory → Profile Editor
    • Edit the Courier App profile
    • Click Add Attribute
    • Enter the following:
      • Data type: string
      • Display name: Role
      • Variable name: role
      • External name: role
      • External namespace: urn:ietf:params:scim:schemas:core:2.0:User
      • Description: Courier Role

  3. Enable Define enumerated list of values and

  4. Enter the following Attribute Members:

RoleSystem Value
AdminADMINISTRATOR
ManagerMANAGER
DeveloperDEVELOPER
DesignerDESIGNER
SupportSUPPORT_SPECIALIST
AnalystANALYST
  1. Enable Attribute required and click Save
warning

Existing users need manual role updates after enabling provisioning.

Create a Courier Bookmark App (Optional)​

info

Contact Courier Support for the Bookmark URL before proceeding.

  1. In Okta admin panel:
    • Click Browse App Catalog
    • Search for Bookmark App
    • Click Add
  2. Configure:
    • App name: Courier Login
    • URL: [From Courier Support]
  3. Click Done
  4. Assign the app integration to the necessary users. See Assign app integrations.

Migrate Existing Users​

  1. From Settings → Security:
    • Ensure Require Google SSO is unchecked
  2. From Settings → Team:
    • Remove users to be migrated
    • Re-invite them through Okta

User Login Process​

  1. Sign out of Courier
  2. Click the join button from the email invite
  3. Enter work email address
  4. Click continue
info

Users with Okta logins must use the email login process:

Troubleshooting​

  • If SCIM provisioning features aren't visible, wait 30 seconds and refresh
  • For SSO issues, ensure email addresses match between Okta and Courier
  • Contact Courier Support for configuration assistance.