Skip to main content
The Okta (SAML) connector integrates the Maverics Orchestrator with Okta using the SAML 2.0 protocol — providing an alternative to the OIDC-based Okta connector for environments that require SAML federation.
Console terminology: In the Maverics Console, this section is called Identity Fabric. The YAML configuration uses the connectors key to define identity provider integrations.

​
Overview

The Okta (SAML) connector supports SAML 2.0 SSO profiles including SP-initiated and IdP-initiated flows. For most deployments, the Okta (OIDC) connector is recommended as the more common integration path. Use the SAML variant when your environment requires SAML-based federation or when integrating with applications that only support SAML assertions.

​
Use Cases

  • Unify SSO for SAML-dependent applications — Connect to Okta via SAML when legacy applications or compliance policies require SAML 2.0 federation instead of OIDC
  • Legacy application modernization — Bridge Okta SAML assertions to header-based or cookie-based authentication for legacy applications, extending SSO without rewriting them
  • Rationalize identity platforms through Okta — Consolidate authentication from multiple IdPs into Okta, reducing licensing overlap and simplifying identity operations
  • Okta failover with Continuity — Pair Okta SAML with a secondary IdP to maintain authentication availability during Okta service disruptions

​
Configuration

To create an Okta (SAML) connector in the Maverics Console:
  1. Navigate to Identity Fabric in the Console sidebar.
  2. Click Create and select Okta (SAML).
The Console also offers Okta (OIDC) for OpenID Connect-based integration, which is the more common option. See the Okta (OIDC) page for details.
  1. Enter a Name — the friendly name for your Okta SAML provider.
  2. Enter the Metadata URL — the URL of the Okta SAML metadata document (e.g., https://{your-org}.okta.com/app/{app-id}/sso/saml/metadata).
  3. Enter the Consumer Service (ACS) URL — the Assertion Consumer Service URL where Okta sends SAML responses.
  4. Enter the Entity ID — the unique identifier for the Orchestrator as the SAML Service Provider.
  5. Optionally enter a Logout Callback URL for Single Logout (SLO) callback.
  6. Optionally enter the SP Certificate Path and SP Private Key Path for signing SAML requests.
  7. Optionally enable IdP Initiated Login to allow authentication flows started by Okta.
  8. Click Save.

​
Troubleshooting

  • Verify the Okta SAML metadata URL is accessible — The Orchestrator fetches the metadata XML at startup. The metadata URL is typically found in the Okta application’s Sign On settings under “Identity Provider metadata.”
  • Ensure the entity ID matches the Okta application — The samlEntityID value must match the Audience URI (SP Entity ID) configured in the Okta SAML application settings.
  • Check the Assertion Consumer Service URL — The samlConsumerServiceURL must match the Single sign on URL configured in the Okta SAML application. If behind a load balancer, use the external-facing URL.
  • SP signing certificate errors — If the Okta application requires signed authentication requests, ensure samlSPCertPath and samlSPKeyPath point to valid PEM files and the key matches the certificate.

Okta (OIDC)

OIDC-based Okta connector (recommended for most deployments)

Generic SAML

Generic SAML 2.0 connector

Identity Fabric

Overview of all identity providers

Continuity

IdP failover connector