Set up SAML SSO with Okta
Let your team sign in to Hyperping through Okta. The setup takes about ten minutes: you create a SAML app integration in Okta, exchange metadata with Hyperping, and run a test login.
Prerequisites
- A Hyperping Business plan. See pricing for plan details.
- The Owner account in Hyperping. Only the Owner can configure authentication settings.
- Admin access to your Okta organization.
Hyperping values used during setup
Okta asks for two Hyperping URLs. Both are shown in the setup wizard, and they are the same for every account:
| Okta field | Value |
|---|---|
| Single sign-on URL | https://api.hyperping.io/saml/acs |
| Audience URI (SP Entity ID) | https://api.hyperping.io/saml/sp |
Step 1: Open the Okta wizard in Hyperping
Go to MembersAuthentication and click Configure on the Okta card.
The wizard stays open while you work in Okta, so keep the tab around. Each step below matches a step in the wizard.
Step 2: Create the SAML integration in Okta
- Create the app integration
In the Okta admin console, go to Applications → Applications, click Create App Integration, select SAML 2.0, and click Next.
- Name the app
Under General Settings, name the app "Hyperping" and click Next.
- Fill in the SAML settings
On the Configure SAML screen, set Single sign-on URL to
https://api.hyperping.io/saml/acsand Audience URI (SP Entity ID) tohttps://api.hyperping.io/saml/sp. - Set the application username
In the Application username dropdown, choose Custom and enter the expression
user.getInternalProperty("id").
The wizard shows the values to paste into Okta, with copy buttons - Submit the feedback form
On the Feedback step, check This is an internal app that we have created and click Finish.
Step 3: Give Hyperping the Okta metadata
The wizard accepts the metadata in two ways. The metadata URL is the recommended one, since Hyperping fetches the SSO URL, issuer, and signing certificate from it and picks up certificate rotations automatically.
- Copy the metadata URL from Okta
Open the app's Sign On tab, find Metadata details, and click Copy next to the Metadata URL.
- Paste it into Hyperping
In the wizard, keep Dynamic configuration selected and paste the URL into Identity provider metadata URL.
- Add your allowed email domains
Enter the email domains your teammates use, for example
yourcompany.com. Hyperping uses the domain to route login attempts to this Okta connection.
If you prefer Manual configuration, enter the Identity provider Single Sign-On URL and Identity provider issuer from the same Sign On tab, and upload the X.509 certificate.
Step 4: Map the SAML attributes
Hyperping expects three attributes in the assertion. In Okta, open Show legacy configuration, click Edit, add the mappings, and click Save:
| Name | Value |
|---|---|
email | user.email |
firstName | user.firstName |
lastName | user.lastName |
Step 5: Assign groups in Okta
Open the app's Assignments tab, click Assign → Assign to Groups, pick the groups that should reach Hyperping, and click Done. Users outside these groups get an Okta error before ever reaching Hyperping.
Step 6: Test the connection
Back in the wizard, click Test Connection. A popup runs a real login against Okta. Once you see Connection successful, click Complete Setup.
Troubleshooting
The test login fails with "user not found"
Your provisioning policy is Invite-only and the Okta user has no Hyperping invite yet. Invite them from the Teammates page first, or switch provisioning to Request access or Auto-provision.
Okta shows an error before the Hyperping login completes
The user is not assigned to the Hyperping app. Check the app's Assignments tab in Okta.
Login worked, then broke after a certificate rotation
If you configured the connection manually with an uploaded certificate, the old certificate expired. Re-upload the current one, or switch to Dynamic configuration with the metadata URL so rotations are picked up automatically.
