This guide walks through configuring SAML 2.0 single sign-on between Okta and Kudoboard.
For general information about how SSO works in Kudoboard, refer to the main Setting up SSO in Kudoboard guide.
Before you start
- You'll need the Tech Admin role in Kudoboard.
- You'll need an Okta admin account with permission to create SAML app integrations.
- Open the Kudoboard SSO page (Admin Panel → SSO) in one browser tab and the Okta Admin Console in another. You'll move values between them.
Step 1 — Create the SAML app in Okta
- In the Okta Admin Console, go to Applications → Applications.
- Click Create App Integration.
- Select SAML 2.0 as the sign-in method and click Next.
- On the General Settings step, enter an integration name (for example, "Kudoboard"). You can optionally upload a logo. Click Next.
Step 2 — Configure SAML
On the Configure SAML step, fill in these fields using values from the Kudoboard SSO Settings page:
| Okta field | What to paste / select |
|---|---|
| Single sign-on URL | Kudoboard's SP Assertion Consumer URL |
| Audience URI (SP Entity ID) | Kudoboard's SP Metadata URL |
| Name ID format | Persistent |
| Application username | Okta username (or any other attribute that stays the same for a given user over time) |
The Name ID format must be Persistent. Kudoboard identifies users by NameID, and Persistent format ensures the value stays stable across email or profile changes. The Application username selection determines what value Okta sends as the NameID; Okta username is the typical choice as long as your org doesn't rename Okta users.
Attribute Statements
In the Attribute Statements (optional) section, add three attribute statements. The names are case-sensitive — type them exactly as shown:
| Name | Name format | Value |
|---|---|---|
Email |
Basic | user.email |
FirstName |
Basic | user.firstName |
LastName |
Basic | user.lastName |
Click Next, then Finish to create the app.
Step 3 — Assign users to the app in Okta
Before anyone can sign in to Kudoboard through Okta, they need to be assigned to the new app. On the app's Assignments tab, assign the people or groups that should have access.
Step 4 — Copy the IdP details from Okta into Kudoboard
On your new app's Sign On tab in Okta, open the SAML setup instructions or view the SAML signing certificate. You'll find these three values that Kudoboard needs:
| Okta value | Paste into Kudoboard's |
|---|---|
| Identity Provider Single Sign-On URL | SSO URL |
| Identity Provider Issuer | Entity ID |
| X.509 Certificate | Public x509 Certificate |
The SLO URL field in Kudoboard is optional. Okta supports single logout; consult Okta's SLO documentation if you want to enable it.
Step 5 — Save and test
- In Kudoboard, set SSO Login Requirements to Optional.
- Click Submit.
- Sign out of Kudoboard, then sign back in via the SSO option. You should be redirected through Okta and back into Kudoboard.
Once a test sign-in works, switch SSO Login Requirements to Required to enforce SSO across your team.
Need help?
If your test sign-in fails or you hit an unexpected error, contact sso@kudoboard.com with the error message and the time of the attempt. Our team can look up the corresponding logs and help.