> ## Documentation Index
> Fetch the complete documentation index at: https://docs.coderabbit.ai/llms.txt
> Use this file to discover all available pages before exploring further.
# Okta SAML SSO setup
> Configure SAML-based single sign-on between Okta Workforce and CodeRabbit from your organization's account management page.
export const EnterprisePlanBadge = ({tip = "This feature is available exclusively as part of the Enterprise plan. Please refer to our pricing page for more information about our plans and features.", title = "Enterprise Plan", cta = "Read more", href = "https://coderabbit.ai/pricing", disabled = false}) => {
return
{title}
;
};
export const AdminRoleBadge = ({tip = "This feature requires an organization owner, an admin role or the corresponding permission. Regular Members do not have access.", title = "Admin Only", cta = "View roles", href = "/management/roles", disabled = false}) => {
return
{title}
;
};
Use this guide to configure Okta Workforce as the identity provider for your CodeRabbit Enterprise organization. The account management SSO wizard guides you through domain verification, SAML app setup, testing, and activation.
After SSO is activated, users with a verified email domain must sign in to CodeRabbit through Okta.
## Before you start
Make sure you have:
* **Critical: You must have an invitation to your CodeRabbit organization from your CodeRabbit account team before starting this setup.**
* Organization admin access in the CodeRabbit account management page
* Access to the **Okta Admin Console**
* Permission to create and configure SAML applications in Okta
* Access to your DNS provider so you can add a `TXT` record for domain verification
* The users or groups that should be allowed to sign in through Okta
If you do not see the **Security** section or the **Start configuration** button in your organization profile, contact your CodeRabbit account team. Your organization must be prepared for self-serve SSO before the account management SSO wizard appears.
## Set up Okta self-serve SSO
Accept your CodeRabbit organization invitation and sign in to the account management page. Open the organization switcher, find the invited organization, and click **Manage**.
In the organization profile, select **Security**, and click **Start configuration**.
In **Domains**, enter the email domain that should use Okta for CodeRabbit sign-in, then click **Add**.
Copy the generated `TXT` record details into your DNS provider:
| DNS field | What to enter |
| ------------ | ------------------------------------------------------------------------------ |
| Type | `TXT` |
| Host or name | The generated host value from the account management SSO wizard |
| Value | The generated `domain-verify=...` value from the account management SSO wizard |
The account management SSO wizard checks DNS automatically. Continue only after the domain shows **Verified**.
In **Connection**, select **Okta Workforce** as the SAML identity provider.
In the Okta Admin Console, go to **Applications** -> **Applications**, click **Create App Integration**, select **SAML 2.0**, and click **Next**.
On **General Settings**, enter a clear app name such as `CodeRabbit`, then continue to the SAML configuration screen.
In **Configure SAML**, use the values shown in the account management SSO wizard:
| Okta field | Value |
| --------------------------- | ------------------------------------------- |
| Single sign-on URL | Copy from the account management SSO wizard |
| Audience URI (SP Entity ID) | Copy from the account management SSO wizard |
| Default RelayState | Leave blank |
| Name ID format | `EmailAddress` |
| Application username | `Email` |
On the Okta feedback screen, select **This is an internal app that we have created**, then click **Finish**.
In the Okta app's **Attribute Statements** section, add the attributes shown in the account management SSO wizard.
| Attribute name | Expression |
| -------------- | ------------------------ |
| `mail` | `user.profile.email` |
| `firstName` | `user.profile.firstName` |
| `lastName` | `user.profile.lastName` |
The `mail` attribute is required. `firstName` and `lastName` are optional in the account management SSO wizard, but adding them helps CodeRabbit populate user profile details correctly.
Open the Okta app's **Assignments** tab and assign the users or groups that should be allowed to sign in to CodeRabbit through Okta.
Users cannot complete SSO sign-in until they are assigned to the Okta application.
In the Okta app, open the **Sign On** tab. Under **Settings** -> **SAML 2.0** -> **Metadata details**, copy the **Metadata URL**.
Return to the account management SSO wizard. In **Configure Okta Workforce**, keep **Add via metadata** selected, paste the metadata URL, and continue.
In **Test**, click **Open test URL** and complete the Okta sign-in flow with an assigned user whose email matches your verified domain.
Return to the account management SSO wizard and click **Refresh logs** until the latest test result shows **Success**. Do not activate SSO while the latest result is **Pending** or failed.
In **Activate**, review the activation message and click **Activate SSO**.
Activation changes sign-in behavior for the verified domain. After activation, users with that email domain must sign in to CodeRabbit through Okta.
## What's next
Return to the SSO overview to understand how Enterprise SSO fits into your CodeRabbit rollout.
Pair SSO with the right access controls by reviewing how roles work in your CodeRabbit organization.
Contact CodeRabbit if the Security section is missing or the SSO test does not succeed.