# Set up SAML with Okta and Screenly


> Organizations can use Okta and Screenly's SAML support for user authentication.

Screenly offers SAML support with Okta. Screenly also supports SAML with Auth0, which you can learn more about [here](/community/saml-sso-with-auth0/), and Azure, which can you find [here](/community/saml-sso-with-microsoft-entra-id/).

SAML stands for "Security Assertion Markup Language" and allows users to transfer identity information between an identity provider (IdP) and a service provider (SP).

Please see below for more information on how to configure Screenly to work with SAML.

## Metadata Location

If this is needed, here are the steps to find your metadata:

Login to your Screenly account (only the account owner can complete this).

Take the first part of the URL showing in your browser - e.g. <https://YOUR-DOMAIN-HERE.screenlyapp.com/>

Then append "sso/saml_metadata_view" to the end of it - e.g. <https://YOUR-DOMAIN-HERE.screenlyapp.com/sso/saml_metadata_view>

An example from a test account would look like: <https://screenly-testing-inc.screenlyapp.com/sso/saml_metadata_view>

This will then bring up a page with your metadata.

## Step by step set up for Okta SAML authentication

**Step 1** &mdash; Register at [okta.com](https://www.okta.com/) and navigate to the admin dashboard.

**Step 2** &mdash; Add the SAML application to your Okta account. To do so, click *Applications* in the sidebar, then click *Create App Integration*. Next, select Web from the Platform dropdown menu. Then, select *SAML 2.0* and click Create.

![Okta SAML setup step 2.](/assets/images/community/okta-step2.webp)

**Step 3** &mdash; The next task is to set your SAML configuration. For the Single sign on URL field, please enter:

<https://login.screenlyapp.com/sso/complete/saml/?idp={domain}>

For the Audience URL (SP Entity ID) field, please enter `login.screenlyapp.com`

You can select Unspecified from the Name ID format drop-down menu.

**Step 4** &mdash; Next, you must set the application's attribute statements.

* For the first attribute, enter `name` with the value `user.login`.
* For the second attribute, enter `email` with the value `user.email`.
* You can leave the Name format field for each attribute as Unspecified.

![Okta SAML setup step 4.](/assets/images/community/okta-step4.webp)

**Step 5** &mdash; On the next page, users must select the "I'm an Okta customer" adding an internal app option.

![Okta SAML setup step 5.](/assets/images/community/okta-step5.webp)

**Step 6** &mdash; After creating the Okta app, users must navigate to the Sign On tab in the app settings section and click View Setup Instructions.

Next, copy the *Identity Provider Single Sign-On URL*, the *Identity Provider Issuer*, and the *X.509 Certificate* to the *SAML single sign-on* section within your online Screenly account (Screenly &rarr; Settings &rarr; Security).

**Step 7** &mdash; Assign your new Okta app to users within your Okta account.

Paste the *Identity Provider Issuer* in the *Entity ID* field. Paste the *Identity Provider Single Sign-On URL* in the *Single sign on URL* field. Paste the X.509 Certificate in the *Public certificate* field without `BEGIN` and `END` certificate lines.

**Step 8** &mdash; Log into your Screenly account, and go to the *SAML single sign-on* section found in Settings &rarr; Security. Note that only a workspace Owner can configure SAML, and it requires a subscription that includes SAML support.

![Okta SAML setup step 8.](/assets/images/community/okta-step8.webp)

**Step 9** &mdash; Click *Import IdP manifest* and select the XML file from step 6 to fill in the configuration fields automatically. You can also enter the fields by hand instead.

**Step 10** &mdash; Click *Save*, and now SAML should be configured. You can test this by clicking *Copy* next to the *Login URL* field that appears once a configuration is saved, logging out of Screenly, then pasting the URL into the browser to login.

**Step 11** &mdash; Return Back to Okta console on Sign On section and fill in RelayState(this field is required if you want to use IdP-initiated flow). RelayState equals hash that takes from the Screenly SAML URL login (/sso/login/saml?idp=**HASH**).

That completes the setup.

## What is the user authorization process with SAML?

![Okta SAML setup authorization.](/assets/images/community/okta-authentication.webp)

First, the owner sends the SAML login url. This is necessary to invite a new user.

Next, the user redirects to the IdP authorization screen.

The next step is for the user to complete authorization. When the user completes IdP authorization, the IdP redirects the user back to Screenly with the IdP's response.

The user can then register as a new user or, if the user already exists, the user can merge his or her account. This process is the same registration process as SSO.

That's all for now!