Set up Okta SAML single sign-on (SSO) for my team

Feature availability

Important: The BioDigital team must first enable SSO for your account. If you are interested in enabling SSO for your team, contact your dedicated Account Manager or our Customer Experience team.

Use this guide to configure Okta SAML single sign-on (SSO) for your BioDigital Human team. Once enabled, eligible users can sign in using their Okta credentials instead of a separate BioDigital password.

Looking for a different configuration guide? See Set up single sign-on (SSO) for my team for links to all supported identity providers and authentication protocols.

 

Before you begin

Before starting configuration, make sure:

  • Your organization uses Okta
  • You have administrator access to your Okta account
  • You also have administrator access to your BioDigital Human team account

 

Step 1: Create a new SAML app integration in Okta

Start by creating a new enterprise application for the BioDigital Human in Microsoft Entra:

  1. Log in to the Okta Admin Console.
  2. Open Applications in the left navigation menu and select Applications.

  3. Click Create App Integration at the top of the page.

    sso_okta_create app integration_jul26.png

  4. In the new window that appears, select SAML 2.0 as your sign-in method.
  5. Click Next.
  6. In the App name field, enter BioDigital Human (or your preferred app name).

  7. (Optional) If desired, upload the BioDigital “B” as your app logo:

    BioDigital-B-color.png

    Click to download
  8. Click Next.

 

Step 2: Configure SAML settings in Okta

Next, configure your new Okta app integration’s SAML settings to work with the BioDigital Human:

  1. Under SAML Settings, enter the following values:
    • Single sign-on URL: https://human.biodigital.com/ws/user/sign/in/okta
    • Check the box next to Use this for Recipient URL and Destination URL
    • Audience URI (SP Entity ID): https://human.biodigital.com/okta/metadata
    • Name ID format: Persistent
  2. Under Application username, select Custom and enter the following expression: user.getInternalProperty("id")
  3. Leave all remaining advanced settings at their default values.
  4. Under Attribute Statements, add the following attributes and values:
    • email (Basic): user.email
    • first_name (Basic): user.firstName
    • last_name (Basic): user.lastName

  5. In the Help Okta Support understand how you configured this application section, check the box next to It’s required to contact the vendor to enable SAML.

    sso_okta_help Okta_jul26.png

  6. (Optional) Complete the remaining questions as desired.
  7. Click Finish.

 

Step 3: Collect your Okta metadata URL

To complete SSO configuration in the BioDigital Human, you will need to retrieve your Okta metadata URL:

  1. Open the BioDigital Human application you just created in Okta.
  2. Navigate to the Sign On tab.
  3. Locate the Metadata URL field and copy the URL value.
    sso_okta_copy metadata url_jul26.png
  4. Store this value for use in Step 4.

 

Step 4: Configure SSO in the BioDigital Human

The final step is to create your SSO configuration in the BioDigital Human using the metadata URL from Microsoft Entra:

  1. Log in to the BioDigital Human.
  2. Click the    profile icon in the upper-right corner and select Team from the drop-down menu.
  3. Click    Manage.
  4. Open the Team Access tab and scroll down.
  5. Under Single Sign-On (SSO) Configuration, click + Add SSO Configuration.
  6. Under SSO Provider, select Okta from the drop-down menu.
  7. Enter a Configuration Name.
  8. Enter the metadata URL you copied in Step 3.3 into the Metadata URL field.
  9. Check the box next to Enable this SSO configuration.
  10. Click Save Configuration.

Success—your Okta SAML integration is now active!

 

What to expect after SSO is enabled

Existing users

The next time an existing team member logs in, they will be prompted to link their BioDigital Human account to your organization's identity provider.

Once linked, future logins will occur through single sign-on (SSO).

New users

New team members will be prompted to authenticate through your organization's identity provider when creating their BioDigital Human account.

If SSO is later disabled, these users will be required to create a BioDigital password.

Administrator fallback login

In the event of an SSO failure, administrators can still log in using their original BioDigital password.

For this reason, password setup remains required for all Administrator accounts.

 

Related articles