Skip to main content
reroutehq
Get Started
SAML SSO guides

Identity provider

Connect Okta

Create a SAML 2.0 app in Okta, point it at the ACS URL and SP Entity ID from ReRoute, then paste Okta's metadata URL back into your workspace SSO settings.

Prerequisites

  • Enterprise plan and the workspace owner role.
  • The sign-in email domain is already an approved domain under Dashboard → Settings → Team.
  • The ACS URL and SP Entity ID / metadata URL from Dashboard → Settings → Single Sign-On — copy them from there; do not hardcode values from this page.
  • Access to the Okta Admin Console with permission to create apps.
  1. 1

    Create a SAML 2.0 app integration

    In the Okta Admin Console go to Applications → Applications → Create App Integration and choose SAML 2.0.
  2. 2

    Name the application

    Under general settings, set the app name to ReRoute HQ (or another name your team will recognize).
  3. 3

    Configure SAML

    On the SAML settings page:
    • Single sign-on URL = the ACS URL from your ReRoute SSO settings. Keep Use this for Recipient URL and Destination URL checked.
    • Audience URI (SP Entity ID) = the SP Entity ID / metadata URL value from ReRoute.
    • Name ID format = EmailAddress.
    • Application username = Email.
  4. 4

    Add an email attribute (recommended)

    Under Attribute statements, add email → user.email.
  5. 5

    Copy the metadata URL

    Finish the wizard, open the app's Sign On tab, and copy the Metadata URL.
  6. 6

    Assign users or groups

    On the Assignments tab, assign the users or groups who should have access to ReRoute.
  7. 7

    Enable SSO in ReRoute

    In ReRoute go to Dashboard → Settings → Single Sign-On, pick the email domain, paste the metadata URL, and choose Enable SSO.

Test the connection

  1. Open an incognito or private window (or a browser where you are not already signed in to ReRoute).
  2. Go to https://reroutehq.com/login, choose Sign in with SSO, and enter a work email on the connected domain that is assigned in Okta.
  3. Complete Okta authentication. On first successful SSO sign-in, a ReRoute account is created and joined to the workspace automatically (just-in-time provisioning).

Sign-in is SP-initiated only. Do not rely on the Okta app tile to launch ReRoute; point the tile at https://reroutehq.com/login or hide it.

Set up SCIM provisioning

Optional. After SSO is connected, enable SCIM so Okta creates and deprovisions workspace members automatically. Generate the SCIM token in ReRoute under Dashboard → Settings → Single Sign-On (SCIM provisioning card; owner-only, Enterprise plan). The plaintext token is shown once.

  1. 1

    Enable SCIM on the app

    In the app's General tab → App Settings → Edit → set Provisioning: SCIM → Save.
  2. 2

    Configure the SCIM connector

    Open the new Provisioning tab → Integration → Edit:
    • SCIM connector base URL = https://reroutehq.com/api/scim/v2
    • Unique identifier field for users = userName
    • Supported provisioning actions: Push New Users and Push Profile Updates (leave Import off)
    • Authentication Mode = HTTP Header; paste the SCIM token from your ReRoute SSO settings as the Bearer token
  3. 3

    Test and save the connector

    Choose Test Connector Configuration, then Save.
  4. 4

    Enable To App actions

    Provisioning → To App → Edit: enable Create Users and Deactivate Users. Save.

Unassigning a user (or deactivating them in Okta) removes their ReRoute workspace membership immediately. SCIM creates Users only (no Groups). Everyone arrives as a member; change roles in Team settings. Users not pushed by SCIM still auto-join on first SSO sign-in.

Notes and troubleshooting

  • One SAML connection per workspace. A domain can belong to only one workspace's connection.
  • Directory sync uses SCIM 2.0 (Users only). Without SCIM, access is controlled by Okta assignments plus just-in-time account creation on first SSO sign-in.
  • If sign-in fails, confirm Name ID format is EmailAddress, the user is assigned to the app, and the email domain matches the domain you selected in ReRoute.
  • Disabling SSO in ReRoute removes the identity provider; members fall back to email/password. Only the owner can disable.