---
title: Configure Okta for Coveo SSO
slug: '1602'
canonical_url: https://docs.coveo.com/en/1602/
collection: manage-an-organization
source_format: adoc
---
# Configure Okta for Coveo SSO
[Okta](https://www.okta.com/products/single-sign-on/) is a service providing single sign-on (SSO) for web and mobile applications.
As a Coveo administrator, you can [implement Security Assertion Markup Language (SAML) 2.0 SSO](https://docs.coveo.com/en/1979.md) when your company uses Okta.
Users can then log in to Coveo without having to provide their authentication credentials since their identity has previously been validated when logging in to their Okta session.
To allow users to log in via SAML SSO, Coveo must be able to trust and rely on Okta to authenticate users wanting to log in.
To establish this trust relationship, you must configure Okta and Coveo so that both parties can exchange authentication information.
This page explains how to proceed.
To configure SSO in more than one Coveo organization, for example in a production organization and a [sandbox organization](https://docs.coveo.com/en/2959.md), configure one of these organizations, and then follow [the instructions](#configure-sso-in-another-organization) at the end of this page.
> **Note**
>
> If you're not the Okta administrator at your company, contact them so that they configure Okta using the following steps.
> Provide them with the Coveo public certificate, which is needed to [encrypt assertions](#encrypt-okta-assertions).
> You can find this certificate on the **Settings** page of the [Coveo Administration Console](https://docs.coveo.com/en/183.md), under **Organization** > [**Single sign-on**](https://platform.cloud.coveo.com/admin/#/orgid/settings/organization/sso) ([platform-ca](https://platform-ca.cloud.coveo.com/admin/#/orgid/settings/organization/sso) | [platform-eu](https://platform-eu.cloud.coveo.com/admin/#/orgid/settings/organization/sso) | [platform-au](https://platform-au.cloud.coveo.com/admin/#/orgid/settings/organization/sso)).
## Configure Okta
Both Okta and Coveo must be configured to work together and provide a SAML SSO service to your Coveo users.
First configure Okta so that it can provide Coveo with user authentication data.
1. Log in to your [Okta Developer](https://developer.okta.com/) account.
1. In the navigation menu of the Okta Admin Console, click **Applications**.
1. Depending on your needs, determine whether you'll [use the pre-configured application](https://docs.coveo.com/en/1602.md#coveo-pre-configured-application) or [create an application manually](https://docs.coveo.com/en/1602.md#manual-application-configuration):
[cols="~,^~,^~"]
|===
| Application | Supports [assertion encryption](https://docs.coveo.com/en/1979.md#assertion-encryption) | Supports [importing groups into Coveo](#about-importing-okta-groups-into-coveo)
| [Pre-configured](https://docs.coveo.com/en/1602.md#coveo-pre-configured-application)
|[No]
|[Yes] [_See below_](#about-importing-okta-groups-into-coveo)
| [Manually created](https://docs.coveo.com/en/1602.md#manual-application-configuration)
| [Yes]
| [Yes]
| === | Name | Name format | Value |
|---|---|---|---|
| `user.email` | Unspecified | `user.email` | |
1. Optionally, click **Add Another** to add more attribute statements.
They all should be in `Unspecified` format.
See [Okta Expression Language](https://developer.okta.com/reference/okta_expression_language/) for reference.
+
**Example**
You could choose to add the following rules:
| Name | Name format | Value |
|---|---|---|
| `user.firstName` | Unspecified | `user.firstName` |
| `user.lastName` | Unspecified | `user.lastName` |
1. Click **Save**.
1. [Assign your application to users and groups](#assign-your-application-to-users-and-groups).
## Assign your application to users and groups
Once you've created an Okta application and configured it so that it passes user authentication to Coveo, you must [assign it to your Okta users](#assign-application-to-users) and/or [groups](#assign-application-to-groups).
Assigning your app to groups is especially useful, as it allows you to [add Okta users in bulk to Coveo groups](#about-importing-okta-groups-into-coveo).
### Assign application to users
Assign your application to the Okta users you want to allow to log in to Coveo using Okta SSO, including yourself:
1. On the **Applications** Okta page, click **Assign Users to App**.
1. On the **Assign Applications** page:
.. Under **Applications**, select your Coveo application.
.. Under **People**, select the users you want to allow to log in to Coveo using Okta SSO.
.. Click **Next**.
.. Review your application assignments, and then click **Confirm Assignments**.
1. Optionally, [assign your application to Okta groups](#assign-application-to-groups).
1. [Prepare to configure Coveo](#prepare-to-configure-coveo).
Alternatively, see [Assign Applications to users](https://help.okta.com/en/prod/Content/Topics/users-groups-profiles/usgp-assign-apps.htm).
### Assign application to groups
Assigning your app to groups is especially useful, as it allows you to [import your Okta groups into Coveo](#about-importing-okta-groups-into-coveo) and add Okta users to Coveo groups in bulk rather than individually.
1. In Okta, add yourself to all groups you're planning to import into Coveo.
This is necessary because Coveo will only show you the Okta groups of which you're a member.
As an administrator, you may therefore want to be a member of all groups.
1. On the **Applications** Okta page, click your Coveo application.
1. On the **Assignments** tab, click the **Assign** dropdown menu, and then click **Assign to Groups**.
1. In the dialog that appears, click **Assign** for each group you want to import into Coveo, and then click **Done**.
1. Edit your Okta application to enter an attribute statement regarding the user groups to import:
.If using a pre-configured app
Details
1. On your Okta application page, select the **Sign On** tab.
1. Next to **Settings**, click **Edit**.
1. In the **user.groups** box, select an operator and enter a value.
> **Note**
>
> Pre-configured applications support entering only one expression.
> If you need to enter more than one expression, [create an application manually](#manual-application-configuration) instead.
For example:
* `Matches .*` imports all Okta groups into Coveo.
* `Contains Department` imports the `Human Resources Department`, `Engineering Department`, and `Sales Department` groups into Coveo, but not the `Engineering Interns` and `Okta Administrators` groups.
* `Equals Support Agents` imports only the `Support Agents` group.
Other groups aren't imported.
Details
1. On your Okta application page, select the **Sign On** tab.
1. Under **Attribute statements**, click **Show legacy configuration**.
1. Click **Edit**.
1. Under **Group attribute statements**, enter at least one attribute statement to specify which Okta groups can be imported Coveo.
The name format must remain `Unspecified`.
+
**Examples**
* The following statement imports all Okta groups into Coveo:
|===
| Name | Name format | Filter
| `user.groups`
| Unspecified
| Matches regex `.*`
| === | Name | Name format | Filter |
|---|---|---|---|
| `user.groups` | Unspecified | Contains `Department` | |
* The following statements imports the `Support Agents`, `Software Developers`, and `User Interface Designers` groups into Coveo.
Other groups aren't imported.
+
| Name | Name format | Filter |
|---|---|---|
| `user.groups` | Unspecified | Equals `Support Agents` |
| `user.groups` | Unspecified | Equals `Software Developers` |
| `user.groups` | Unspecified | Starts with `User` |