Skip to main content

Okta: SSO, SCIM & IdP Setup Guide

Okta guide on SAML SSO setup and enforcement, optional SCIM provisioning, the Okta-specific Bookmark App for dashboard access, and consolidated troubleshooting.

Written by Meryl Mizell

Article Summary

This is the single guide for connecting Okta to AutoRFP. It covers, in order: SAML SSO setup and enforcement (required), optional SCIM provisioning for automatic user sync, an Okta-specific convenience feature (a working dashboard tile via a Bookmark App), and consolidated troubleshooting for all three.

Estimated Time

  • SAML SSO setup (required): 5–10 minutes, including verifying user assignment before you enforce.

  • SCIM provisioning (optional): 15–20 minutes.

  • Bookmark App / dashboard access (optional): < 5 minutes, once SAML SSO is configured and enforced.

Prerequisites

  • Administrator permissions in AutoRFP.

  • Administrator permissions in Okta — sufficient to create a SAML app and assign users to it.

  • Confirmation that every AutoRFP user's account email matches (or can be made to match) their Okta email address.

  • Access to both the AutoRFP admin panel and the Okta admin console, ideally in separate browser tabs.

  • Coordination with your team about the upcoming login method change.

  • If you plan to add SCIM (optional): SCIM OAuth credentials generated in AutoRFP (Client ID and Client Secret) — see How to Activate SCIM in AutoRFP.

‼️ Important: SSO is an organization wide change. Once you enforce it, every AutoRFP user in your organization must sign in through Okta, and AutoRFP password-based login stops working. Email mismatches between Okta and AutoRFP are a common cause of failed logins after enforcement — reconcile them before you enforce.

Step-by-Step Instructions

Part 1: SAML SSO Setup

Setting up SAML SSO with Okta touches two places: the AutoRFP setup wizard and the Okta admin console. Work through the parts in order.

Step 1: Start the AutoRFP.ai Setup Wizard

In tab 1:

  1. Sign in to AutoRFP.ai.

  2. Go to Organization Settings → Integrations.

  3. In the Single Sign-On section, select Okta as your provider, then select Setup.

  4. Keep this wizard open in its own browser tab to use for next steps.

Step 2: Create AutoRFP.ai App in Okta

In tab 2:

  1. Log in to your Okta admin console.

  2. Follow the steps defined in tab 1, the AutoRFP.ai setup wizard, see screenshots below:

1. Navigate to the Admin Dashboard in Okta and Select Application > Applications. Click the Create App Integration Button.

2. Select SAML 2.0 as the Sign on method and click Next.
​
3. On the General Settings tab, fill in the details of the new application and click Next

App Name: AutoRFP.ai

*You can leave the rest of the fields with their default values.
​
4. On the Configure SAML tab, fill in the details and click Next


​Single Sign On URL: https://auth.app.autorfp.ai/__/auth/handler

Audience URI (SP Entity ID): sp:autorfp.ai

Default Relay State: https://app.autorfp.ai/

Name ID Format: Select "Email Address"

Application Username: Select "Email"


5. (Optional) Fill out Feedback


6. Click Finish

Step 3: Enter Okta Details

  1. Continue following the steps defined in the AutoRFP.ai setup wizard. See screenshots below:

1. Navigate to the Application you just created and find the “Assignments” tab.

2. Assign yourself to the application.

3. Navigate to the Application you just created and find the “Sign On” tab.

4. Navigate to SAML Settings in the General tab and enter the following details into the corresponding fields:

📝 Note: Certificate text, must start with '-----BEGIN CERTIFICATE-----', followed by a new line (ENTER key), then the full certificate text, then another new line (ENTER key) end with '-----END CERTIFICATE-----'.
​
A missing new line or partially-copied certificate is a common cause of failed connections.

Step 4: Assign Users and Enforce

  1. Continue in the AutoRFP wizard to the step that lists your AutoRFP users.

  2. Switch to Okta, open your AutoRFP SAML application's Assignments tab, and assign every listed user — individually or via Okta groups.

  3. Return to AutoRFP once all users are assigned, and confirm the wizard's user list is fully covered.

  4. Select Enforce SSO and confirm. You'll be logged out and prompted to re-authenticate using Okta.

Expected result: Every listed user appears assigned in Okta, and after selecting Enforce SSO you are signed out and redirected to Okta to sign back in.

Part 2: SCIM Provisioning (Optional)

SCIM enables automatic user creation, updates, and deactivation between Okta and AutoRFP. Requires SAML SSO (Part 1) to already be configured.

Step 1: Enable Provisioning in Okta

  1. In Okta, open your AutoRFP SAML application → General tab → Edit in App Settings.

  2. Under Provisioning, select SCIM and click Save.

Step 2: Configure SCIM Connection Settings

  1. In your Okta AutoRFP.ai app, click Provisioning → Edit in the SCIM Connection section.

  2. Enter the SCIM connector base URL that corresponds to your AutoRFP.ai URL:

    1. app.autorfp.ai → https://api.autorfp.ai/scim/v2

    2. eu.autorfp.ai → https://api.eu.autorfp.ai/scim/v2

    3. us.autorfp.ai → https://api.us.autorfp.ai/scim/v2

  3. Set Unique identifier field for users to userName.

  4. Under Supported provisioning actions, select Push New Users and Push Profile Updates.

  5. Set Authentication Mode to OAuth 2

  6. Set Grant Type to Client Credentials.

  7. Enter the Token Endpoint URI that corresponds to your AutoRFP.ai URL:

    1. app.autorfp.ai → https://api.autorfp.ai/oauth/token

    2. eu.autorfp.ai → https://api.eu.autorfp.ai/oauth/token

    3. us.autorfp.ai → https://api.us.autorfp.ai/oauth/token

  8. In your AutoRFP.ai tab, navigate to Settings → Integrations → Provisioning

  9. In the Okta tile, click Manage Credentials

  10. Paste your Client ID and Client Secret (generated in AutoRFP), then click Save.

Step 3: Authenticate with AutoRFP.ai

  1. Click Authenticate with AutoRFP.ai.

  2. Verify you see a green confirmation message.

If the authentication fails, double-check your credentials and base URL match your AutoRFP region.

Step 4: Configure SCIM Provisioning Features

  1. Stay in the Provisioning tab, select To App → Edit in the Provisioning to App section.

  2. Toggle ON: Create Users, Update User Attributes, Deactivate Users. Click Save.

📝 Note: AutoRFP only supports updating these fields via SCIM: First Name, Last Name, Username (Email), Job Title, Active Status. Okta may show additional attributes; AutoRFP's SCIM server ignores unsupported fields, so there's no need to remove them.

Step 5: Set DisplayName to Read-Only

  1. In the To App tab, scroll to Attribute Mappings and locate displayName.

  2. Edit it, change Apply On from "Create and update" to Create only, and Save.

This ensures DisplayName is only set during initial user creation, not on every sync.

Part 3: Dashboard Access via Bookmark App (Optional)

AutoRFP's Okta SAML connection is service-provider-initiated only, so Okta's default app tile behavior doesn't give users a working dashboard shortcut. Create an Okta Bookmark App instead, pointed at AutoRFP's IdP SSO URL, so users can launch AutoRFP directly from their Okta dashboard without an error. Requires SAML SSO (Part 1) to already be configured and enforced.

Step 1: Locate the IdP SSO URL in AutoRFP

  1. Navigate to Organizational Settings > Integrations in AutoRFP.

  2. Locate the Okta SSO section and find the IDP SSO URL field.

  3. Copy the URL to your clipboard — this is what you'll paste into Okta in Step 4.

Step 2: Open the Okta Application Catalog

  1. Log in to your Okta admin console → Applications → Browse App Catalog.

Step 3: Find and add the Bookmark App

  1. Type "Bookmark App" into the search bar and select the tile from the results.

  2. Click Add Integration.

Step 4: Configure the Bookmark App

  1. Application Label: enter a descriptive name (e.g., "AutoRFP.ai").

  2. URL: paste the IDP SSO URL you copied in Step 1.

  3. Click Done or Save.

Step 5: Assign users to the Bookmark App

  1. Open the Assignments tab, click Assign > Assign to People or Assign to Groups.

  2. Select the users/groups, click Assign, then Done.

Step 6: Verify user access

  1. Log in to Okta as a test user, check the dashboard for the AutoRFP bookmark tile, and click it.

  2. Confirm it redirects through Okta's sign-on flow and lands the user signed in to AutoRFP.

Expected result: The test user sees an AutoRFP tile on their Okta dashboard. Clicking it signs them straight in, with no separate login prompt.

‼️ Important: Assignment does not carry over between the Bookmark App and the underlying SAML app. A user assigned to one but not the other will either not see the tile, or see it but fail to sign in.

🛠️ Troubleshooting

Grouped by which part of setup they relate to.

SAML Sign-In Issues

AutoRFP rejects the pasted Okta configuration, or the connection never establishes

The SSO URL or Audience URI pasted into Okta doesn't match what AutoRFP's wizard displayed, or was copied with extra whitespace/truncation. Re-copy both values directly, don't retype.

Certificate rejected by AutoRFP, or sign-in fails after Step 3

The X.509 certificate is missing header/footer lines, was copied partially, or is an expired certificate after a rotation. Re-copy the current, active certificate in full.

A user can see the Okta dashboard but can't sign in to AutoRFP

The user isn't assigned to the AutoRFP SAML application in Okta — check the Assignments tab.

Okta authentication succeeds, but AutoRFP rejects the user afterward

The email Okta asserts doesn't match the user's AutoRFP account email. Confirm both match exactly (case-normalized) and correct whichever side is wrong.

Sign-in fails with a wrong-organization or wrong-tenant error

The user signed in to a different Okta org than the one where the AutoRFP SAML application was created (e.g. a sandbox org, or credentials from a previous role). Confirm the Okta org URL matches.

Some users can sign in, others can't

Almost always an email mismatch or missing assignment for the affected users specifically.

SCIM Provisioning Issues

Test Connector Configuration fails

Double-check that your Client ID, Client Secret, and SCIM connector base URL all match your AutoRFP region.

Wrong regional SCIM base URL or token endpoint

Re-check both URLs against the region table in Part 2, Step 2, and re-test.

Incorrect Client ID or Client Secret

Regenerating credentials in AutoRFP after pasting them into Okta will break the connection. Regenerate if needed, then re-paste both values.

userName not set as the unique identifier field

If left at Okta's default instead of userName, Okta may fail to match existing users or create duplicates. Confirm and re-save.

Users don't appear in AutoRFP after provisioning

Confirm the user is assigned to the AutoRFP app in Okta — SCIM only pushes assigned users — and that Push New Users is still enabled.

Bookmark App / Dashboard Access Issues

The bookmark tile doesn't appear on a user's Okta dashboard

The user (or their group) isn't assigned to the Bookmark App — check the Assignments tab (Part 3, Step 5).

Clicking the tile does nothing, or shows an error

The URL field on the Bookmark App is wrong — confirm it's an exact, unmodified copy of AutoRFP's IDP SSO URL, not the general login page or a retyped version.

The tile redirects to AutoRFP, but the user isn't signed in

The user is assigned to the Bookmark App but not the underlying SAML application — confirm both.

💡 Tips & Best Practices

  • Verify user assignments in Okta match AutoRFP's user list before you enforce, not after.

  • Add new users to both AutoRFP and the Okta application at the same time.

  • Monitor Okta's System Log for authentication errors in the hours after you enforce SSO.

  • Keep the AutoRFP wizard and Okta admin console open in separate tabs.

  • Test the SCIM connection before enabling provisioning features, and start with a small pilot group.

  • Keep Bookmark App assignments in sync with the SAML app assignments — a user needs both for a working, signed-in tile.

✋🏼 Common Mistakes to Avoid

  • Not keeping both the AutoRFP and Okta tabs open — slows down configuration and increases copy/paste errors.

  • Copying configuration details incorrectly (SSO URL, Audience URI, certificate).

  • Forgetting to assign users to the Okta application.

  • Enforcing SSO without verifying that email addresses match.

  • Forgetting to set userName as the SCIM unique identifier, or not setting displayName to "Create only".

  • Configuring the Bookmark App before SAML SSO is fully set up — the IDP SSO URL won't exist yet.

  • Assigning users to the Bookmark App but forgetting the main SAML app — the tile appears but sign-in fails.

Related Guides

Microsoft Entra ID: SSO, SCIM & IdP Setup Guide
Activate SCIM in AutoRFP
SCIM 2.0 Technical Reference

Need Help?

💬 Live Chat: Available in-app

📚 Learning Centre: learn.autorfp.ai/en

Related Articles
Did this answer your question?