Okta SSO Setup Guide (SAML)
Use this guide to enable Single Sign-On (SSO) using the SAML 2.0 protocol for an individual Alteryx One Platform workspace using Okta.
Required Permissions
To enable SSO with Okta, you must satisfy these requirements:
Be a user on a Professional, Enterprise, or Legacy-1 Alteryx One plan.
Have a Workspace Admin role assigned to you, or a custom role that includes the Single Sign-Out capability.
Have administrative access in the target Okta instance.
Okta Setup
Follow these steps to create an OIDC app integration in Okta:
Nota
Do not enable Assertion Encryption in Advanced Settings. Alteryx One Platform does not support assertion encryption and instead uses HTTPS to protect SAML payloads.
Nota
Do not enable Signed Requests in Advanced Settings. Okta’s signature verification for requests is incompatible with Alteryx One Platform.
Sign in to your Alteryx One workspace.
Go to Profile menu > Workspace Admin > Single Sign-On.
Under Protocol, select SAML.
Note and copy the prepopulated Assertion Consumer Service URL. You will use this later.
Note and copy the prepopulated Service Provider Entity URL. You will use this later.
Sign in to your Okta Portal as an administrator.
Select Create App Integration.
Select SAML 2.0.
In the App Name field, enter a name for your app. For example, the name of your Alteryx One workspace.
Select Next.
Under General, in the Single sign on URL field, paste the Assertion Consumer Service URL value you copied from your Alteryx One workspace.
Under General, in the Audience URI (SP Entity ID) field, paste the Service Provider Entity ID value you copied from your Alteryx One workspace.
Select Finish.
Select the I'm an Okta customer adding an internal app option.
Select Finish.
Under Sign-On, in the Attribute Statements section, select Add Expression.
In the Name field, enter
email.Next to the Name field, in the Expression field, enter
user.profile.email.Select Save.
In the Name field, enter
firstName.Next to the Name field, in the Expression field, enter
user.profile.firstName.Select Save.
In the Name field, enter
lastName.Next to the Name field, in the Expression field, enter
user.profile.lastName.Select Save.
From the app page, go to Sign On > Settings > Metadata Details and then note and copy the Metadata URL. You will use this later.
Alteryx One SSO Setup
Return to your Alteryx One workspace and then follow these steps:
Configure SSO
Go to Workspace Admin > Single Sign-On.
Under Protocol, select SAML.
In the Email Mapping SAML Attribute field, enter
email.In the Given Name Mapping Attribute field, enter
firstName.In the Family Name Mapping Attribute field, enter
lastName.In the Metadata URL field, paste the Metadata URL value you copied from Okta.
Select Import From URL. Multiple fields should auto-populate.
Select Save. Alteryx One redirects you to the Test Connection page.
Select View Configuration Details.
Note and copy the prepopulated Relay State URL. You will use this later.
Go back to the application in the Okta Portal.
Go to General > SAML Settings and then select Edit.
Go to Default Relay State and then paste the Relay State URL value you copied from your Alteryx One workspace.
Select Save.
Select Finish.
Test Connection
Return to your Alteryx One workspace.
Select Test Connection. A dialog then opens, prompting you to sign in to verify the integration.
Enter your Okta credentials if you aren't already signed in. The dialog automatically closes if the integration has been verified.
Enable SSO
Select Enable SSO.
Select Confirm. Once enabled, users can only sign in to the workspace using their Okta credentials.