Add Okta Workforce as a SAML connection

Set up an enterprise connection in Clerk

To create a SAML connection in Clerk:

1. In the Clerk Dashboard, navigate to the SSO connections⁠ page.
2. Select Add connection and select For specific domains or organizations.
3. Under SAML, select Okta Workforce.
4. Enter the Domain. This is the email domain of the users you want to allow to sign in to your application. Optionally, select an Organization.
5. Enter the Name. This will be displayed on the sign-in form.
6. Select Add connection. You'll be redirected to the connection's configuration page.
7. In the Service Provider Configuration section, save the Single sign-on URL and Audience URI (SP Entity ID) values somewhere secure. You'll need these in the Configure your service provider step.
8. Keep this page open.

Create a new enterprise application in Okta

To create a new enterprise application in Okta:

1. Navigate to Okta⁠ and sign in.
2. In the Okta dashboard, select Admin in the top right corner.
3. In the navigation sidebar, select the Applications dropdown and select Applications.
4. Select Create App Integration.
5. In the Create a new app integration modal, select the SAML 2.0 option and select the Next button.
6. Once redirected to the Create SAML Integration page, complete the General Settings fields. An App name is required.
7. Select Next.

Configure your service provider

Once you have moved forward from the General Settings instructions, you will be presented with the Configure SAML page.

To configure your service provider (Clerk), you must add these two fields to your IdP's application:

• Single sign-on URL - This is your application's URL that your IdP will redirect your users back to after they have authenticated in your IdP.
• Audience URI (SP Entity ID) - This is a unique identifier for your SAML connection that your IdP application needs.

To fill out the appropriate values for these fields:

1. Paste the Single sign-on URL and the Audience URI (SP Entity ID) values that you saved earlier into their respective fields.

Map Okta claims to Clerk attributes

Mapping the claims in your IdP to the attributes in Clerk ensures that the data from your IdP is correctly mapped to the data in Clerk.

1. In the Okta dashboard, find the Attribute Statements (optional) section.
2. For the Name field, enter mail.
3. For the Value field, choose user.email from the dropdown.
4. Select the Add Another button to add another attribute.
5. For the Name field, enter firstName.
6. For the Value field, choose user.firstName from the dropdown.
7. Select the Add Another button to add another attribute.
8. For the Name field, enter lastName.
9. For the Value field, choose user.lastName from the dropdown.
10. Scroll to the bottom of the page and select the Next button to continue.
11. You will be redirected to the Feedback page. Fill out the feedback however you would like and select the Finish button to complete the setup.

Assign selected user or group in Okta

You need to assign your users/user groups to your enterprise application. For example, if you were part of the Clerk organization, you would have access to users and groups in the Clerk organization. In this case, you could assign one or more users or entire groups to the enterprise application you just created.

1. In the Okta dashboard, select the Assignments tab.
2. Select the Assign dropdown. You can either select Assign to people or Assign to groups.
3. In the search field, enter the user or group of users that you want to assign to the enterprise application.
4. Select the Assign button next to the user or group that you want to assign.
5. Select the Done button to complete the assignment.

Configure your identity provider

Once you have completed the setup in Okta, you will be redirected to the application instances page with the Sign On tab selected.

1. Under Sign on methods, copy the Metadata URL.
2. Navigate back to the Clerk Dashboard and find the Identity Provider configuration section.
3. Under the Metadata configuration option, paste the Metadata URL.
4. Select the Fetch & save button to complete the setup.

Enable the connection for Clerk

To make the connection available for your users to authenticate with:

1. In the Clerk Dashboard, you should still have the connection's configuration page open. If not, navigate to the SSO connections⁠ page and select the connection.
2. Toggle on Enable connection and select Save.