SAML 2.0 for CodeSignal with Okta (OIN app)

CodeSignal supports SAML 2.0 Single Sign-On (SSO). This guide walks an Okta administrator through adding the CodeSignal application from the Okta Integration Network (OIN) catalog and connecting it to a CodeSignal organization.

Prerequisites

Before you begin, make sure you have:

• An Okta tenant with administrator access.
• A CodeSignal organization on a plan that includes SSO. If SSO is not enabled for your organization, contact support@codesignal.com.
• An administrator role in your CodeSignal organization.

Supported features

The Okta CodeSignal application supports the following SAML 2.0 features:

• IdP-initiated SSO (recommended) — users sign in by clicking the CodeSignal tile on their Okta dashboard.
• SP-initiated SSO — users sign in from the CodeSignal login page using the Enterprise SSO button.
• Just-in-Time (JIT) user provisioning (optional) — new CodeSignal accounts are created automatically on first SSO login. The role applied to JIT-created users is configurable in CodeSignal.

For more information on the listed features, see the Okta glossary in the Okta Help Center (help.okta.com).

Configuration steps

Step 1: Add the CodeSignal app from the OIN catalog

1. In the Okta Admin Console, go to Applications › Applications.
2. Click Browse App Catalog.
3. Search for CodeSignal, then click the result.
4. Click Add Integration.
5. On the General Settings tab, optionally edit the Application label, then click Next.
6. On the Sign-On Options tab, leave the default SAML settings in place and click Done.

Step 2: Copy the SAML metadata from Okta

1. Open the newly added CodeSignal application in Okta.
2. Go to the Sign On tab.
3. Click on more details (or expand SAML Signing Certificates › Actions › View IdP metadata).
4. Copy the following three values — you will paste them into CodeSignal in the next step:

• Identity Provider Single Sign-On URL
• Identity Provider Issuer
• X.509 Certificate

Step 3: Configure CodeSignal with the Okta metadata

1. Sign in to CodeSignal as an organization administrator.
2. Go to Organization Settings.
3. In the Single Sign-On card, enable SSO and fill in the fields:

• Identity provider SSO login URL — paste the Identity Provider Single Sign-On URL from Step 2.
• Identity provider issuer — paste the Identity Provider Issuer from Step 2.
• X.509 certificate — paste the certificate from Step 2 (including the -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- lines).

4. (Optional) Enable JIT (Just-in-Time) provisioning and select a default role. With JIT enabled, CodeSignal creates accounts automatically the first time a user signs in via Okta. Without JIT, users must already exist in CodeSignal (manually invited or provisioned via SCIM).
   1. Note that you need to have “Owned email domains” configured for your account for the functionality to work. Reach out to the support team to set them up.
5. (Optional) Enable Restrict password authentication to require all users in the organization to sign in via SSO. Make sure every user can sign in through Okta before enabling this option.
6. Click Save.

Step 4: Provide the CodeSignal Service Provider values to Okta (if requested)

The CodeSignal OIN application is pre-configured with the correct Service Provider values, so you do not normally need to set them by hand. For reference, the values are:

Step 5: Assign users and test sign-in

1. In Okta, open the CodeSignal application and go to Assignments.
2. Assign the users or groups who should have access to CodeSignal.

1. Have one of the assigned users sign in to verify the integration:

• IdP-initiated: click the CodeSignal tile on the Okta dashboard.

• SP-initiated: go to https://identity.codesignal.com/auth/login and click "Continue with Single Sign-On."

SAML assertion attributes

CodeSignal reads the SAML NameID as the user’s email address and uses it to look up or provision the account. By default, CodeSignal also reads the following optional attribute statements from the SAML response:

The attribute names above are the CodeSignal defaults. If your Okta tenant uses different attribute names, contact support@codesignal.com to align the mapping.

Notes

• IdP-initiated flow is recommended. When configuring SSO, make sure you use the URL for the IdP-initiated flow and not the URL for the SP-initiated (CodeSignal-initiated) flow.
• NameID must equal the user’s email. CodeSignal matches users by email, so the SAML NameID must contain a valid email address that matches the user’s CodeSignal account (or one that JIT will create).
• SSO and SCIM are independent. You can use SAML SSO on its own (with or without JIT), or pair it with SCIM provisioning. See the SCIM section of this document for automated user and group provisioning.

Troubleshoot

Support contact

If you encounter issues that are not covered above, contact CodeSignal support at support@codesignal.com.