SSO with Okta

Teams

This guide walks you through setting up SAML Single Sign-On between Okta and Lynkle.

Before you start

  • A Lynkle Teams subscription with organization owner role
  • Okta admin access with permission to create applications
  • Access to your domain's DNS settings
  • Each SSO user invited to your Lynkle organization

Setup

  1. Get your Lynkle SP values

    In Lynkle, go to Settings > Security. Note the three values displayed below the identity provider configuration form:

    • SP Entity ID (Audience URI)
    • ACS URL (Single Sign-On URL)
    • Metadata URL
  2. Create a SAML application in Okta
    1. Sign in to the Okta Admin Console.
    2. Go to Applications > Applications.
    3. Click Create App Integration.
    4. Select SAML 2.0 and click Next.
    5. Enter "Lynkle" as the app name, optionally upload a logo, and click Next.
  3. Configure SAML settings in Okta

    On the Configure SAML page, enter:

    • Single sign-on URL: paste the ACS URL from Lynkle
    • Audience URI (SP Entity ID): paste the SP Entity ID from Lynkle
    • Name ID format: select EmailAddress
    • Application username: select Email

    Leave the other fields at their defaults and click Next.

    Lynkle identifies users by email address. Make sure the Name ID format is set to EmailAddress and the application username is set to Email.

    On the Feedback page, select I'm an Okta customer adding an internal app and click Finish.

  4. Copy the Okta values to Lynkle

    After creating the app, go to the Sign On tab. In Lynkle (Settings > Security), enter:

    • Entity ID: the Issuer value from the SAML setup instructions
    • SSO URL: the Sign on URL from the SAML setup instructions
    • Signing Certificate: click Actions > Download certificate on the active signing certificate and paste its contents

    Click Save Configuration.

  5. Assign users in Okta
    1. In your Lynkle application, go to the Assignments tab.
    2. Click Assign and choose Assign to People or Assign to Groups.
    3. Select the users or groups who should have access and click Done.

    Users must be assigned to the Lynkle application in Okta before they can sign in via SSO.

    Invite the same people under Settings > People in Lynkle. Their first SAML login creates their Lynkle account if needed and activates the invited membership.

  6. Verify your domain in Lynkle
    1. In Lynkle (Settings > Security), scroll to the Verify Domains section.
    2. Enter your email domain (for example, yourcompany.com) and click Add Domain.
    3. Lynkle displays a DNS TXT record to add:
      • Host: _lynkle-sso.yourcompany.com
      • Value: the verification token shown in the dashboard
    4. Add this TXT record in your DNS provider.
    5. Once the DNS record has propagated, click Verify in Lynkle.
  7. Configure policies

    Optionally enable Require SSO for all team members to enforce SSO login for non-owner members.

    See SAML SSO for details on these policies.

Testing

Before enforcing SSO, test the connection:

  1. Open an incognito or private browser window.
  2. Go to the Lynkle login page and click Single Sign-On (SSO).
  3. Enter the email address of a user assigned to the Lynkle application in Okta.
  4. You should be redirected to Okta's sign-in page. After authenticating, you should be signed in to Lynkle.

You can also test from the Okta side by clicking the Lynkle tile on the user's Okta dashboard.

If the test fails, check that the Name ID format is set to EmailAddress and that the user is assigned to the application.

Troubleshooting

  • "SAML authentication failed" error: Verify that the Audience URI and Single sign-on URL in Okta exactly match the SP values shown in Lynkle. Also confirm the signing certificate hasn't expired.
  • User sees "You do not have access" from Okta: The user hasn't been assigned to the Lynkle application. Add them under the Assignments tab.
  • Okta shows "Invalid SAML Response": Check that the ACS URL in Okta uses HTTPS and matches exactly (no trailing slash differences).
  • Domain verification fails: DNS propagation can take up to 48 hours. Confirm the TXT record is set on _lynkle-sso.yourcompany.com (not the bare domain) with the exact verification token value.