SAML/SSO with Okta

One of the SAML identity providers (IdP) you can use is Okta.
Before setting up your Okta integration, please read over our Understanding SAML/SSO article to learn basic concepts and useful tips.
In order to get started with the setup of SSO with Okta, you will need:
  • Okta account with admin permissions.
  • Admin or super-admin user role within Hudu.
  • All users are provisioned in Okta with the same exact email address. We don't create new user accounts with SSO.
  • Ensure that the users have already been created in Hudu before starting this process.



How to Enable SSO

  • Login to Hudu and click the Admin tab on the top toolbar.
  • Click General.
  • Click Configure Single Sign-On.
  • Enter SAML details. See the relevant section below on how to fill this information out.
  • Click Enable Single Sign-On.
  • Hit Update SAML Details and SAML should now be activated.


Configuring Okta

  • Inside Okta, click Admin in the top right.
    • Navigate to the Applications screen and click create app integration.


  • When the modal pops up, select SAML 2.0, and then click "Next".


  • On the next screen, give the Application a name.


  • In Configure SAML, fill in the following fields:
    • Single sign-on URL: Enter the URL of your Hudu instance followed by /saml/consume
      • e.g.
    • Audience URI: Enter the URL of your Hudu instance.
      • e.g.
    • Name ID format: Choose EmailAddress.
    • Application username: Choose Email.


  • Click "Show Advanced Settings" and fill out the following fields:
    • Signature Algorithm: Choose RSA-SHA1
    • SAML Issuer ID: fill in exactly:${org.externalKey}


  • Click Next.
  • Now, choose:
    1. I'm an Okta customer adding an internal app.
    2. This is an internal app that we have created.


  • Then click Finish
  • On the next screen, click View Setup Instructions.


  • Keep the setup instructions open as you fill out the info in Hudu.


Configuring Hudu

  1. In Hudu, with a user role of Admin or Super Admin:
    • Navigate to your Hudu admin area >> General >> SAML/SSO Configure.
  2. Provide Identity Provider (IdP) information:
    • SAML Issuer URL: This is what Okta calls their "Okta Identify Provider Issuer." Copy this exactly into Hudu.
    • SAML Login Endpoint: This is what Okta calls their "Okta Identity Provider Single Sign-On URL." Copy this exactly into Hudu.
    • SAML Logout Endpoint: This will be the same as your Login URL; the "Okta Identity Provider Single Sign-On URL." Copy this exactly into Hudu.
    • SAML Fingerprint:
      • To ensure that you are obtaining the correct fingerprint (thumbprint) for your algorithm:
        • Copy the certificate.
        • Paste the certificate into a tool such as
        • Choose either SHA-1 or SHA-256 as the algorithm.
          • If choosing SHA-256, you will also need to ensure that the 'Use SHA-256' option is checked (in the Hudu SAML setup area).
        • Copy either the non-formatted or formatted fingerprints provided and paste them into Hudu SAML Fingerprint.
    • SAML Certificate: This is provided by Okta, and should be the same certificate used to configure the fingerprint; copy this exactly.
      • -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- should be included.
      • Paste into the SAML Certificate field. Make sure there is no extra space trailing at the end!
    • SAML ARN: This signifies the Authentication Context that Hudu will provide to the IdP. AuthnContext is the method by which a user tries to log in (i.e. via password, passwordless, etc.).
      • If you specify Do not pass RequestedAuthnContext in your request, the URN is used by the IdP to say "I don't want to tell you how I identified the user".
        • Requested Authentication Context may be required for your IdP, but it is typically optional.
        • If you have users that use Passwordless login to your IdP; do not pass RequestedAuthnContext must be selected.
      • If you specify Password in your request, the IDP knows it has to authenticate the user through login/password.
      • If you specify PasswordProtectedTransport in your request, the IDP knows it has to authenticate the user through login/password, protected by SSL/TLS.
  3. Click Enable Single Sign-On.
  4. Hit Update SAML Details and SAML should now be activated.


Testing SAML

Open an incognito window and try and access Hudu. You should be redirected to the login page, where you will see a "Use Single Sign On (SSO)" button. If you are able to successfully login via this button, your SAML is working!

Disable Password Access for non-Admins

You have the option to disable password logins for non-administrators (users that are not super admins or admins). By clicking "Disable Password Access for non-Admins"; all users below admin will have to exclusively use single sign-on to access your Hudu environment.
Admins will be able to access via an admin sign-in page. This will prevent you from being locked out of your account when your Identity Provider is unavailable.
Was this article helpful?
0 out of 0 found this helpful