Set up SSO integration with Okta

Single Sign-On (SSO) allows users to access the Infobip web interface using credentials managed by an external Identity Provider (IdP). This tutorial explains how to configure and test SSO integration between Infobip and Okta using the SAML 2.0 protocol.

After completing this tutorial, users in your organization can log in to the Infobip web interface through Okta without needing separate Infobip credentials.

Prerequisites

An Infobip account. If you do not have an account, sign up (opens in a new tab) for an account.
Account admin role on the Infobip web interface to configure SSO settings.
A trial or paid Okta account with Admin privileges to access the Okta Admin Console.
Ability to create and manage applications and test users in Okta.

Process overview

Configure SSO on the Infobip web interface.
Create and configure a SAML 2.0 application in Okta.
Retrieve SAML setup information from Okta and add it to Infobip.
Assign users to the Okta application.
(Optional) Enable auto-create users and groups.

Implementation steps

Configure SSO on the Infobip web interface

Log in to the Infobip web interface (opens in a new tab).
Go to Account settings → Security → Single Sign-On (SSO).
Select Configure to open the SSO setup page.
Enter a meaningful SP Entity ID (also called your custom domain). This automatically generates the SP Assertion Consumer Service (ACS) URL.
Note the SP Initiation URL. Users use this URL to initiate SSO login.

NOTEThe SSO configuration is fully self-service. No additional data is required from Infobip as the Service Provider. All necessary details are provided during the setup process.

Create and configure the Okta application

Log in to the Okta Admin Console.
Go to Applications → Create App Integration.
Select SAML 2.0 as the sign-in method and proceed.
Fill in the following fields in Okta using data from the Infobip web interface:
- Single sign on URL: In the Infobip web interface, fill in your custom domain for SP Initiation URL, then copy the SP Assertion Consumer Service URL from there and paste it into this field in Okta. Example: https://portal.infobip.com/login/saml/mycustomdomain/callback. This is the URL you need to use to actually log in with this SSO.
- Audience URI (SP Entity ID): Copy the SP Entity ID from the Infobip web interface and paste it into this field in Okta. Example: https://portal.infobip.com/login/saml/mycustomdomain
Enable Use this for Recipient and Destination URL for the Single sign on URL.
Save the application.

Retrieve Okta SAML setup information

In the Okta Admin Console, open your created application.
Go to the Sign On tab.
Scroll down and select View SAML setup instructions.
Copy the following values from the Okta SAML instructions page into the corresponding fields in the Infobip SSO configuration:
- IdP Login URL: Copy the Identity Provider Single Sign-On URL from Okta and paste it into the IdP Login URL field in the Infobip web interface SSO setup.
- Identity Provider Issuer: Copy the Identity Provider Issuer from Okta and paste it into the Identity Provider Issuer field in the Infobip web interface SSO setup.
- IdP Signature Certificate: Copy the X.509 Certificate from Okta (or download and open with a text editor) and paste it into the IdP Signature Certificate field in the Infobip SSO setup.

NOTEBefore saving the X.509 certificate in the Infobip SSO configuration, you must remove all new lines from the certificate text. You can use the find and replace feature in a text editor like Notepad++ to remove line breaks.

Assign users to the Okta application

In the Okta Admin Console, go to Applications.
Select your SAML application.
Go to the Assignments tab and select Assign.
Choose Assign to People or Assign to Groups.
Assign the users or groups who should have access to Infobip through SSO.

Optional: Enable auto-create users and groups

To allow automatic user and group creation in Infobip upon SSO login, configure the following settings.

Auto-create users

In the Infobip SSO configuration, enable Auto-create users. When enabled, Infobip automatically creates a user account upon the first successful SSO login.

Auto-create groups

In the Infobip SSO configuration, enable Auto-create groups. When enabled, Infobip synchronizes user groups from Okta on each login.
In the Okta SAML application, configure the following Group Attribute Statement:
- Name: http://schemas.xmlsoap.org/claims/Group
- Name format: Basic
- Filter: Matches regex (configure as needed)

NOTEInfobip automatically creates teams that match the Okta groups and assigns users accordingly. After team creation, you must manually assign roles to the teams for permissions to take effect.

Additional configuration and security

Regularly rotate certificates and secrets: Update certificates and secrets on both Okta and Infobip periodically to maintain security.
Monitor audit logs: Track SSO login activities in Infobip audit logs to identify unauthorized access attempts or configuration issues.

Testing

To verify the SSO integration:

Open the SP Initiation URL (for example, https://portal.infobip.com/login/saml/mycustomdomain) in a browser. Alternatively, go to the Infobip login page and select Login with SSO.
You are redirected to Okta for authentication.
Log in with an Okta user account that is assigned to the application.
After successful authentication, Okta sends a SAML response to Infobip.
Infobip processes the response and grants access to the web interface.

NOTEIf auto-create users is enabled, a new user account is automatically created in Infobip upon the first successful login. If auto-create users is disabled, the user must already exist in Infobip with an email address that matches the NameID in the SAML response.

Troubleshooting

Verify that the SP Entity ID and Audience URI match exactly on both the Infobip and Okta sides.
Ensure the Single sign on URL in Okta matches the SP Assertion Consumer Service URL from Infobip.
Confirm that the NameID format is set to EmailAddress in the Okta application.
Check that users are assigned to the Okta application.
Remove all new lines from the X.509 certificate before saving it in Infobip.
Use the SP Initiation URL to test the login flow.
Review SAML response attributes if login fails.
Infobip supports only the SP-initiated SAML flow.