Set up Krisp SSO with Okta

Krisp single sign-on (SSO) uses SAML 2.0. This article walks you through the up-to-date team-level Okta setup (custom SAML app), and includes optional SCIM steps for automated user provisioning.

Before you begin

• Make sure you can access the Krisp Admin Portal for your team.
• Make sure you have admin permissions in Okta.
• If you plan to use SCIM, you must configure SAML SSO first.

Configure SSO

Step 1: Open Krisp SSO settings

1. Go to the Krisp Admin Portal.
2. Open Team Settings >>> Security >>> Authentication.
3. Check the Enable SSO box.
4. Click SAML to open the Configure SAML panel.
5. Keep this panel open, as you'll copy values from here during the Okta setup.

Step 2: Create a SAML 2.0 app integration in Okta

1. In Okta, go to Applications >>> Applications.

2. Click Create App Integration.

   

3. Select SAML 2.0 as the sign-on method.

4. Click Next.

   

General Settings

1. Enter an App name (example: Krisp).
2. (Optional) Upload an App logo (PNG/JPG/GIF).
3. Click Next.

Configure SAML

In the Configure SAML screen, set:

• Single sign on URL: Copy the Reply URL (Assertion Consumer Service URL) from Krisp and paste it here.
• Audience URI (SP Entity ID): Enter a custom value (example: Krisp).
• Application username: Select Okta username.

Finish setup

1. Select This is an internal app that we have created.
2. Click Finish.

Step 3: Add the email attribute (required)

1. Open the app's Sign On settings.
2. Click Show legacy configuration, then click Edit.
3. Under Profile Attribute Statements, add:
   • Name: email
   • Value: user.email

Step 4: Copy Okta SSO details into Krisp

1. In Okta, scroll to the Sign On Settings area.

2. Click View SAML setup instructions.

   

3. Copy the following values from Okta into Krisp settings:
   • Identity Provider Single Sign-On URL >>> paste into the matching Krisp field
   • X.509 certificate (certificate text) >>> paste into the matching Krisp field

4. In Krisp, click Configure to save.

   

Step 5: Assign users or groups (who can sign in via SSO)

1. In Okta, open your Krisp SSO app and go to the Assignments tab.
2. Click Assign and choose:
   • Assign to People, or
   • Assign to Groups
3. Assign the users or groups who should be able to sign in to your Krisp team using SSO.

Once assigned, users can sign in using your team slug and authenticate through Okta.

Notes and limitations

• The team slug is modifiable, but must be unique.
• If you belong to multiple Krisp teams with SSO, you can't use your email instead of the team slug during sign-in.
• You can enable Enforce SSO only if you (as an Admin) are currently logged in via SSO.

Optional: Set up SCIM provisioning in Okta

SCIM lets Okta automatically provision, update, and deactivate users in Krisp. Recommended for teams managing large user bases.

Step 1: Enable SCIM in Krisp

1. In the Krisp Admin Portal, go to Team Settings >>> Security >>> Authentication.
2. Click SCIM.
3. Turn on Enable SCIM.
4. Copy the values shown:
   • SCIM token
   • SCIM endpoint

Step 2: Enable provisioning in the Okta app

1. In Okta, open the Krisp SSO integration app.
2. Go to General (General settings) and click Edit.
3. Select SCIM as the provisioning option.
4. Click Save.
5. Go to the new Provisioning tab and click Edit.

Step 3: Configure SCIM connection details

In Okta Provisioning settings, set:

• SCIM connector base URL: paste the SCIM endpoint from Krisp
• Unique identifier field for users: email
• Supported provisioning actions:
  • Import New Users and Profile Updates
  • Push New Users
  • Push Profile Updates
• Authentication Mode: HTTP Header
• Authorization: paste the SCIM token from Krisp

• Click Test Connector Configuration, confirm it succeeds, then click Save.

Step 4: Enable provisioning actions to Krisp

1. In Okta, under Provisioning, open To App and click Edit.
2. Enable:
   • Create Users
   • Update User Attributes
   • Deactivate Users
3. Click Save.

What to expect

• When SCIM is active, provisioning and deprovisioning should be done from the IdP (Okta), and users appear in Krisp right after they're added in Okta.
• When only SAML SSO is active (no SCIM), users typically appear in the Krisp dashboard after they sign in the first time.