How to Configure Single Sign On (SSO) with Okta in Triofox AI

Enable SSO:

Click on Configure under the "Single Sign On" block in the settings page.

Inside "Single Sign On" toggle on "Enable SAML Single Sign On". From here, configure the settings desired for SSO and then click "Apply". You can always come back to change the settings.

• Force signin via ID Provider: automatically takes user to SSO when logging in from clients and organization URL.
• Enable SSO for windows and mac clients: let users sign in with SSO from windows and mac clients.
• Enable SSO for mobile clients: let users sign in with SSO from mobile clients.

Configure SSO on Okta:

On the Okta admin console portal, select Applications under Applications and click on the "Create App Integration" button.

Select "SAML 2.0" on the popup page and select "Next" to continue.

Type in a name for the application and click "Next" to continue.

On the next page, configure settings with the information provided on the Triofox.AI SSO Configuration page.

1. For "Single sign-on URL", copy and paste the link under "Assertion Consumer Service (ACS) URL" from the Triofox.AI SSO configuration page.
2. For "Audience URI (SP Entity ID) ", copy and paste the link under "Access service provider meta data using the following link" from the Triofox.AI SSO configuration page.
3. Select "Email" for "Application username".
4. Finally, scrolled down and click "Next" to continue.

Scroll down and click "Finish" to create the application.

On the application page, navigate to the Assignments tab and then click on "Assign" to assign users or groups to be able to use SSO to log in to Triofox AI.

On the application page, navigate to the Assignments tab. Click on "More Details" and then copy the Sign on URL.

Select the "ID Provider" tab in SSO settings and click on the gear icon.

Then,

• Select "Okta" for "Select SAML ID provider" and click "Continue".
• Paste in the link we just copied for "Issuer URL" and click "Continue.

Using SSO

To use SSO on web portal, access Triofox.AI from your custom DNS address, which can be set in web portal by accessing Settings->Branding.

You will also see the option to use SSO after entering your username on the normal portal.

Finally, use the "Login via IDP using the following link" link to directly access the SSO sign in page if needed.

If "Enable SSO for windows and mac clients" is toggled on, an option to sign in with SSO will be displayed after the username is entered and the user clicked continue.

If "Enable SSO for mobile clients" is toggled on, an option to sign in with SSO will be displayed after the username is entered and the user clicked continue.