Setup Single Sign-On (SSO) with Okta for your Avoma accounts

Use Avoma's SSO with Okta for streamlined access management and unified login experience for your users

Introduction

Single sign-on (SSO) is an authentication method that enables users to securely authenticate with multiple applications and websites by using just one set of credentials. SSO works based upon a trust relationship set up between an application, known as the service provider, (in this case Avoma) and an IDP (identity provider), like Okta, Azure AD, One Login etc.

This help article documents the process of setting up SSO with Okta using the Open ID connect (OIDC) protocol or SAML 2.0 protocol for your Avoma account.

While we recommend Okta Open ID Connect (OIDC) as the preferred authentication protocol for SSO with Avoma, we also support SAML 2.0 authentication protocol. 

You can choose either ways to setup SSO. 

Setting up SSO for Avoma with Okta OIDC.

Setting up SSO for Avoma with Okta OIDC is a two step process.

1. Create an Avoma app in Okta with OIDC option
2. Provide details to set up Okta OIDC in Avoma.

Step 1 : Set up Avoma app in Okta

Prerequisite : You must be an admin in Okta to be able to set up Avoma app in Okta for SSO

1. Log in to your Okta account > Admin > Applications section.
   
2. Click on Create App Integration
   
3. Select "OIDC" as the Sign-In Method and "Web Application" as the Application Type. Then click on the "Next" button.
   
4. In the General settings, enter "Avoma (OIDC)" as the App integration name and select “Authorisation Code“ as the grant type.
5. In the Login section, enter “https://app.avoma.com/okta/oidc“ in the Sign-in redirect URIs field and “https://app.avoma.com/login“ in the Sign-out redirect URIs field
6. In the controlled access section, choose “Skip group assignment for now“
7. Click Save. A custom OIDC Okta app will be created. Continue to configure the app and assign users to it.
8. Make note of the Client credentials - Client ID and Client Secret.
9. Go to the LOGIN in the General tab.
10. In the “Login initiated by” section, select “Either Okta or app”.
11. For Application Visibility, select “Display application icon to users“
12. For Login flow, select Redirect to app to initiate login (OIDC Compliant).
13. For Initiate login URI, enter: https://app.avoma.com/oidc/login
    
14. Click Save.
15. Click the Sign On tab and go to the Open ID Connect ID Token section.
16. For the Issuer URL, select Okta URL. Make a note of it. The URL usually appears in the following format: https://<companyname>.okta.com.
    
    
17. Now go to the Assignments tab and assign the app users and/or groups that should have access to Avoma.

Step 2: Set up Okta OIDC in Avoma

Currently, Avoma sets up an SSO on your behalf for your organization. Please contact Avoma Support or your Customer Success Manager and provide the following details:

1. Client ID
2. Client Secret
3. Issuer URL

Once Avoma has configured SSO for you, you will receive a confirmation. Avoma will also terminate the existing sessions for all your users so that they can freshly log in using SSO.

Your users can then start using the SSO option on the Avoma login screen to access their accounts. 

Setting up SSO with Okta SAML 2.0

Setting up SSO for Avoma with Okta SAML is a two step process.

1. Create an Avoma app in Okta with SAML 2.0 option
2. Provide details to set up Okta SAML SSO in Avoma.

Step 1 : Create an Avoma app in Okta with SAML 2.0 option

Prerequisite : You must be an admin in Okta to be able to set up Avoma app in Okta for SSO

1. Log in to your Okta account > Admin > Applications section.
   
2. Click on Create App Integration
   
3. Select "SAML 2.0" as the Sign-In Method and "Web Application" as the Application Type. Then click on the "Next" button.
   
4. Enter the App Name on the next screen and hit Next. 
5. In the SAML settings section , enter "https://prod-api.avoma.com/saml2/acs" in the Single sign-on URL and enable the checkbox .  In the Audience URI and Default Relay state enter "https://app.avoma.com" . 
6. Select "Email Address" for the Name ID format  , "Email" for Application User Name and "Create and Update" for Update Application Username on setting. 
   
7. In the Attribute Statements section, enter values as shown below
   
8. Scroll down to click Next. Select "It's required to contact vendor to enable SAML" and click Finish. 
9. Your SAML app creation is complete. You will be shown a screen with details about the Metadata URL and Issuer. Copy the Metadata URL and Issuer. 
   
   
10. Now go to the Assignments tab and assign the app users and/or groups that should have access to Avoma.

Step 2: Provide details to set up Okta SAML SSO in Avoma

Currently, Avoma sets up an SSO on your behalf for your organization. Please contact Avoma Support or your Customer Success Manager and provide the following details:

• Metadata URL copied in Step 1
• Issuer copied in Step 1

Your users can then start using the SSO option on the Avoma login screen to access their accounts.