SAML authentication with Okta

Zenskar supports single sign-on (SSO) through SAML 2.0, letting an organization authenticate users through its existing identity provider. This guide sets up SAML in Zenskar using Okta as the identity provider. Zenskar does not control Okta’s admin console, and Okta may rename or move fields at any time. Each Okta label in this guide is paired with the SAML 2.0 concept it maps to, which does not change, so a rename does not break the mapping. The labels were accurate on 2 September 2026; if one no longer matches what you see, match on the concept and use Okta’s current guide to creating a SAML app integration to find the field.

---

​

Step 1: Verify your domain

1. Click the account menu at the bottom of the sidebar, and select Settings.
2. Open the SAML tab.
3. In the Connection section, enter a Name for this configuration and the Domain to verify, for example acme.com. Enter the bare domain, with no https:// prefix and no path.
4. Click GET TXT RECORDS.
5. Add the resulting TXT record to the domain’s DNS.
6. Click VERIFY DOMAIN once the record has propagated. The domain’s status changes from Pending to Verified.
7. Under Identity Provider, select Okta from the dropdown.

​

Step 2: Set up the application in Okta

Create a SAML 2.0 app integration for Zenskar, and assign the people and groups who should be able to sign in to Zenskar. A user who is not assigned cannot sign in.

​

Service provider values

From the Zenskar SAML Configuration Values section on the SAML tab, enter these in Okta: The ACS URL appears once Okta is selected on the SAML tab in Step 1. Copy it and the Entity ID exactly as shown.

​

NameID

​

Attribute statements

Attribute names are case-sensitive and must contain no spaces. If the first or last name attribute is missing, Zenskar asks the user to enter their name on first sign-in. Leave anything else at its default, and finish creating the app.

​

Step 3: Finish in Zenskar

In Okta, open the app’s Sign On tab and select View SAML setup instructions. On Zenskar’s SAML tab, in the Identity Provider Configuration section, enter these values: Then set the four Attribute Mapping fields to the attribute names from Step 2. Turn on SAML Status and click Save Configuration. Zenskar checks the form first: with SAML Status on, the Name, Domain, both Identity Provider Configuration values, the Certificate, and all four attribute mappings are required, and the single sign-on URL must use https. See Field validation for the certificate format and the other checks. Good to know

• A user who already has a Zenskar password confirms it once, on their first SSO sign-in, to link their account. Every sign-in after that goes through Okta.
• Once the domain is verified and SAML Status is on, invited users no longer receive a password-setup email; their account is created on first SSO sign-in.
• To change an Identity Provider Configuration value later, edit the field with SAML Status on and click Save Configuration again. A save made while SAML Status is off is stored but does not update the live connection.

​

Step 4: Test

1. Test in a private or incognito window: go to the Zenskar sign-in page, enter the work email address of an assigned user, and continue. The sign-in should route to Okta and return to the Zenskar dashboard.
2. Test with a second assigned user before announcing it to the team. This confirms the group assignment works, not just one account.

​

Step 5: Give your team a working tile

Sign-in must start from the Zenskar side, so replace Okta’s default tile:

1. In Okta, stop the app from showing its default dashboard tile.
2. Create an Okta Bookmark App that points at your Zenskar sign-in page, and assign it to the same people and groups.

Users then get a Zenskar tile that opens the sign-in page, where SSO completes normally. If you would rather not add a Bookmark App, ask your team to bookmark the Zenskar sign-in page in their browser instead.

​

Troubleshooting and upkeep

Reach out to help@zenskar.com with questions while going through setup.