Company Sign-In with Okta

Before You Start

• In TagLogger, open Settings, Company sign-in, pick Okta (SAML), and choose Start setup. Or open the setup link your TagLogger owner sent you.
• Verify your email domains first. See Company Sign-In.
• You need an Okta administrator role that can create app integrations.

Create the App

1. In the Okta Admin Console, open Applications and choose Create App Integration, then SAML 2.0.
2. Name it TagLogger and continue.
3. Under SAML Settings, paste the values TagLogger shows and keep Use this for Recipient URL and Destination URL checked:

Single sign-on URL            https://taglogger.com/__/auth/handler
Audience URI (SP Entity ID)   https://taglogger.com/sso/saml/<connection ID>
Name ID format                EmailAddress
Application username          Email

4. Under Attribute Statements, add email with the value user.email.
5. Under Show Advanced Settings, keep Assertion Signature set to Signed and Assertion Encryption set to Unencrypted. TagLogger does not accept encrypted assertions.
6. Finish the wizard.

The address Okta sends must be the one each person uses for TagLogger, at a verified domain.

Connect TagLogger to Okta

1. On the app’s Sign On tab, copy the Metadata URL.
2. In TagLogger, under Identity provider, choose Metadata URL, paste it, and save. TagLogger reads it daily, so a new Okta signing certificate is picked up by itself.
3. On the Assignments tab, assign the people or groups who should use TagLogger.
4. In TagLogger, choose Test sign-in and sign in as an assigned user at a verified domain. When the test passes, the owner turns the connection on.

The Okta Dashboard Tile

TagLogger accepts sign-ins that start from TagLogger, and Okta’s tile for a SAML app starts the sign-in at Okta. To give users a working tile:

1. In the TagLogger app’s General settings, check Do not display application icon to users.
2. Add a Bookmark App named TagLogger with the sign-on URL TagLogger shows, https://taglogger.com/login?sso=<connection ID>, and assign it to the same people.

Directory Sync

With directory sync, Okta adds people to TagLogger when you assign them and removes them when you unassign or deactivate them. In TagLogger, under Provisioning, choose Directory sync and Create token. Then in Okta:

1. On the app’s General tab, choose Edit, select SCIM as the provisioning method, and save.
2. On the Provisioning tab, under Integration, enter:

SCIM connector base URL                https://api.taglogger.com/scim/v2
Unique identifier field for users      userName
Supported provisioning actions         Push New Users, Push Profile Updates
Authentication Mode                    HTTP Header
Authorization                          <token from TagLogger>

3. Choose Test Connector Configuration, then save.
4. Under To App, enable Create Users, Update User Attributes, and Deactivate Users.
5. Optional: to set roles from groups, open Push Groups and push the groups you want TagLogger to map. Leave it unused if access should not follow groups.

Okta sends the application username as userName. With the settings above, that is the user’s email, which is what a sign-in matches.

See Also

• Company Sign-In
• Microsoft Entra ID
• Google Workspace