Integrate Okta SSO

Okta SAML/SSO integration

Connect Okta with Tallyfy using SAML-based Single Sign-On (SSO) for automatic authentication and user provisioning. Takes about 30 minutes.

Requirements

Okta administrator account
A Tallyfy administrator account on any paid plan
The Tallyfy SP values from the SSO wizard (shown when you pick Okta)

Setup overview

Create an Okta SAML application
Configure settings in both systems
Test the connection in the Tallyfy wizard, then turn SSO on

Phase 1: Create Okta SAML application

Step 1: Create a new app

Sign in to the Okta Admin Console
Switch to Classic UI from the dropdown in the top left header
Go to Applications > Applications
Click Add Application
Select Create New App
In the dialog, select Web for Platform
Select SAML 2.0 for Sign-on method
Click Create

Step 2: Configure general settings

Enter “Tallyfy” as the application name
Optionally upload the Tallyfy logo
Click Next

Phase 2: Configure SAML settings

Step 1: Obtain Tallyfy SAML values

Grab Tallyfy’s SAML values first - these tell Okta where to send login data:

In Tallyfy, go to Settings > Organization > Security > SSO
Start a new connection and pick Okta as the provider
Copy the SP ACS URL and SP Entity ID shown on the first step of the wizard

Step 2: Enter SAML settings in Okta

Now configure Okta with those values:

Single Sign On URL: Enter the value from Tallyfy’s “SP ACS URL” field
Keep Use this for Recipient URL and Destination URL checkbox selected
Audience URI (SP Entity ID): Enter the value from Tallyfy’s “SP Entity ID” field
Click Show Advanced Settings
Change Authentication context class to X.509 Certificate

Step 3: Configure attribute statements

Tell Okta which user info to send to Tallyfy:

Name	Name Format	Value
email	Unspecified	user.email
FirstName	Unspecified	user.firstName
LastName	Unspecified	user.lastName

Okta SSO setup workflow configuration screen

After adding the attributes, click Next

Step 4: Complete Okta configuration

Select I’m an Okta customer adding an internal app
Check This is an internal app that we have created
Click Finish

Phase 3: Configure Tallyfy with Okta info

Step 1: Get Okta SAML details

Go to the Sign On tab in your Okta application
Scroll down and click View Setup Instructions
The page shows the identity provider’s SAML config details

Okta also gives you an Identity Provider metadata link on this page. Copy it if you’d rather use the metadata URL method.

Step 2: Paste Okta details into the Tallyfy wizard

Back in the Tallyfy SSO wizard (Settings > Organization > Security > SSO), move to the Enter IdP details step and pick a method:

Metadata URL - paste the Okta Identity Provider metadata link. Tallyfy fetches and parses it. Easiest option.
XML paste - paste the metadata XML if you downloaded it instead.
Manual entry - enter the Identity Provider Single Sign-On URL, the Identity Provider Issuer, and the X.509 Certificate.

Step 3: Test and enable

Run the wizard’s Test connection step. It checks your metadata and certificate. Fix anything it flags.
Once the test passes, click Enable to turn SSO on for your organization

User provisioning and access

Once SSO is active:

Get your org’s SSO login URL from the SSO wizard (it’s shown next to the connection)
Share this URL with users who have access to the Okta application

Here’s how it works for your users:

Already have a Tallyfy account? They’ll log in automatically
No account yet? If auto-join is on and their email is on a verified domain, Tallyfy creates an account on first login. Verify your domain under the Domains tab first. See Domain verification.

SSO authentication flow

The full authentication process from setup to user access:

Key points:

Steps 1-6 are the one-time self-serve setup you run yourself across Tallyfy and Okta
Steps 7-14 happen every time a user logs in
Tallyfy auto-creates accounts for new users from a verified domain (step 13) using the email and name attributes from Okta

Set up SCIM provisioning (optional)

SAML handles login. SCIM handles your user roster. With Okta’s SCIM 2.0 provisioning on, Okta pushes assignments and deactivations to Tallyfy automatically, so accounts appear and disappear in step with Okta and you stop paying for people who’ve left.

In Tallyfy, go to Settings > Organization > Security > SCIM and turn SCIM on
Copy the Base URL and the bearer token (the token shows once, so store it safely)
In Okta, open your Tallyfy app and go to the Provisioning tab, then Configure API Integration
Check Enable API integration, paste the Tallyfy Base URL into the SCIM connector base URL field, and paste the bearer token as the API token
Click Test API Credentials, then save. Under To App, enable Create, Update, and Deactivate Users.

To map Okta groups to Tallyfy roles, push groups whose names match Tallyfy’s reserved group names (for example tallyfy-admins). Full details are in SCIM provisioning.

Troubleshooting

Can’t log in? Check these first:

Is the user assigned to the Okta application?
Are attribute mappings exactly right? Names and formats matter.
Are users hitting the SSO URL, not the regular Tallyfy login page?
Still stuck? Contact Tallyfy Support.

Authentication > Integrate OneLogin SSO

Set up SAML-based Single Sign-On between OneLogin and Tallyfy yourself. Create a custom SAML…

Authentication > Integrate Microsoft Entra ID SSO

Tallyfy integrates with Microsoft Entra ID (formerly Azure Active Directory) for self-serve SAML…

Integrations > Authentication and SSO

Tallyfy offers free, self-serve SSO and SCIM on any paid plan with support for Microsoft Entra…

Authentication > Integrate JumpCloud SSO

Set up SAML-based SSO between JumpCloud and Tallyfy yourself by creating a custom SAML app, then…

Was this helpful?

Get in touch

About Tallyfy