Skip to content
FreesbeFreesbe DocsBack to freesbe.net

Set up single sign-on with Okta

How-toFor adminsReviewed Guides: Single sign-on, Admin Center

Northwind Traders uses Okta, so people sign in to Freesbe with the same Okta account, its second step and its device rules, and Okta decides who gets in. This connects them over SAML, in about ten minutes. Okta’s OpenID Connect works too: see the end.

Before you start

Section titled “Before you start”
  • Single sign-on with your own provider comes with the Corporate and Enterprise plans.
  • Verify your company’s email domain in the Admin Center under People → Joining → Email domains (see Let people join with their work email). Your provider can only sign in addresses at a verified domain.
  • You need to be an owner of the workspace in Freesbe, and able to add apps in Okta.
  • Keep the Freesbe page open in one tab and Okta in another: you copy details both ways.

1. Start in Freesbe

Section titled “1. Start in Freesbe”
  1. Open the Admin Center: Security → Sign-in & access → Single sign-on.
  2. Choose Okta and SAML 2.0, then Set up Okta.
  3. The page shows Add Freesbe to Okta with the details to copy. Leave it open.

2. Add Freesbe to Okta

Section titled “2. Add Freesbe to Okta”
  1. In the Okta Admin Console, go to Applications → Applications and click Create App Integration. Choose SAML 2.0 and click Next.
  2. Name it Freesbe and click Next.
  3. Under SAML Settings, paste Freesbe’s Reply URL into Single sign-on URL and its Entity ID into Audience URI (SP Entity ID).
  4. Set Name ID format to EmailAddress and Application username to Email.
  5. Optionally, under Attribute Statements, add firstName, lastName or displayName, so new people get their name. Click Next, then Finish.
  6. On the app’s Sign On tab, copy the Metadata URL.
  7. On the Assignments tab, assign the people or groups who use Freesbe, yourself included.

3. Tell Freesbe about Okta

Section titled “3. Tell Freesbe about Okta”

Under Tell Freesbe about Okta, paste the metadata URL and click Save. Freesbe shows the issuer, sign-in URL and the certificate it read, and reads it again every day.

4. Test it

Section titled “4. Test it”
  1. Back on the Freesbe page, under Test it, click Test sign-in.
  2. Sign in to Okta as yourself. You’re brought back to the page, which says Signed in and shows what Okta sent: your email address, name and any other attributes.
  3. Nobody else can sign in through Okta until a test goes through. Once it has, people at your domain choose Sign in with your company’s SSO on the sign-in page.

To make everyone use it, see Require single sign-on for everyone.

If the test doesn’t sign in

Section titled “If the test doesn’t sign in”

The page says why. The usual reasons:

  • “isn’t at one of this workspace’s verified email domains”: Okta sent an address at another domain, or a username instead of the email. Send the user’s primary email as the name ID (Name ID format EmailAddress, Application username Email).
  • “isn’t signed with the identity provider’s certificate”: the certificate Freesbe has isn’t the one Okta signs with. Paste the metadata URL again, or upload the new metadata file.
  • “for another app (Audience)” or “isn’t for this sign-in address”: the entity ID or reply URL in Okta doesn’t match Freesbe’s. Copy them again from step 1; they end in /metadata and /acs.
  • “is encrypted”: turn off assertion encryption for the Freesbe app.
  • The provider shows its own error (often “not assigned”): give yourself access to the Freesbe app in Okta.

See Single sign-on for everything else.

With OpenID Connect instead

Section titled “With OpenID Connect instead”

Choose OpenID Connect in step 1. In Okta, create an OIDC - OpenID Connect app of type Web Application, paste Freesbe’s Redirect URL under Sign-in redirect URIs, and assign people. In Freesbe enter the issuer (your Okta address, such as https://northwind.okta.example), and the app’s Client ID and Client secret.