Set up Okta as the Identity Provider Using SAML 2.0

Configure Okta SAML single sign-on for Cortex XDR.

This procedure configures Okta to authenticate Cortex XDR users. Okta screens and procedures can change. Review the Okta app integration documentation for current details.

You need Cortex XDR access and the Account Admin or Instance Administrator role.

1

Configure Okta groups

Assign users to Okta groups that match Cortex XDR user groups. Use a common identifier in group names, such as Cortex XDR.

Record each Okta group and its corresponding Cortex XDR user group.

2

Copy Cortex XDR values

In Cortex XDR, go to Settings → Configurations → Access Management → Single Sign-On.

Expand SSO Integration. Copy Single Sign-On URL and Audience URI (SP Entity ID).

3

Configure the Okta application

Create a Cortex XDR SAML application in Okta. Enter the copied values as Single sign-on URL and Audience URI (SP Entity ID).

Set Default RelayState to the Audience URI. Configure Okta to sign both the response and assertion.

Configure these SAML attributes:

• Email address

• Group membership, using memberOf

• First name and last name

Filter groups using your chosen identifier. Record the exact attribute names.

4

Copy Okta identity values

On the application Sign On tab, select View SAML setup instructions.

Copy Identity Provider Single Sign-On URL, Identity Provider Issuer, and the X.509 Certificate.

5

Configure Cortex XDR

In the Cortex XDR SSO Integration settings, map these values:

• Okta Identity Provider Single Sign-On URL → IdP SSO URL

• Okta Identity Provider Issuer → IdP Issuer ID

• Okta X.509 Certificate → X.509 Certificate

Enter the recorded attributes in IdP Attributes Mapping. Names must match exactly. Save your changes.

6

Map groups and test access

Map each Okta group in the target Cortex XDR user group's SAML Group Mapping field. Separate multiple groups with commas.

Open the Cortex XDR tenant URL and select Sign-In with SSO. Verify that the user receives the expected roles.

Note

SAML users must sign in at the Cortex XDR tenant URL. They cannot sign in through Cortex Gateway.