SAML SSO with Okta

Here's a guide to get started with SAML SSO with Okta for your Whimsical workspace, but you can also check Okta’s documentation.

Note:

In Okta:Link to this section

1. Sign in to the Okta Admin app to generate a metadata file.

  • From the Whimsical SAML app in your Okta Admin Console, click Actions > View IdP metadata next to your SAML Signing Certificates:
  • Then Save the metadata file that is provided by Okta as metadata.xml

2. Next, log in to your Whimsical account as an administrator.

3. In Whimsical:Link to this section

First, go to Workspace settings, which you'll find under your workspace name in the top left corner:

Then, enable SAML SSO. Once it's enabled:

  • Select Okta from the “Identity Provider” dropdown list
  • Make a note of the “ACS URL” value
  • Upload the metadata.xml file from step 2 in the “SAML Metadata XML” field
  • Click Save

After that’s saved:

  • Make a note of the “LOGIN URL” value
  • Leave the “Require SAML for login” option disabled for now until you make sure the SAML configuration works successfully

In Okta:Link to this section

4. Select the Sign On tab for the Whimsical SAML app, then click Edit:

  • Scroll down to the “ADVANCED SIGN-ON SETTINGS” section
  • Enter the “ACS URL” value you made a copy of in step 4
  • Click Save
  • Finally, don't forget to test the setup to ensure everything is working correctly.

After that’s done, you can go back to your Whimsical Workspace settings and adjust two more things:

  • Default user role: Whimsical supports JIT (Just-in-time) account provisioning. That means that Whimsical will create an account for a user authenticating via SAML if necessary. New users will be created with the role and permissions you choose:
    • Editors - paid role with full ability to create and edit content
    • Viewers - free role with read and comment-only limited permissions
  • Require SAML for login: You can enable this optional setting if you want to prevent users from accessing your workspace with other means of authentication, such as a password or via Google SSO.

There are some attributes that are the same for all identity providers:

Whimsical uses the e-mail address of the SAML user to identify them on Whimsical. This will come up with configuration options like Name ID Format or Name ID. When in doubt, try to choose the option that will return the user's e-mail.

Written by:

  • Dārta

    Dārta