Okta
Note: The Keeper app in the Okta website was originally configured for SSO Connect On-Prem version and we've adapted the instructions in this guide to work with Keeper SSO Connect Cloud™.
Be sure to have already performed the steps in the Admin Console Configuration section.
Login to the Admin section of the Okta portal.
​
Select the Applications tab and select Add Application.
Search for Keeper Password Manager, and then select the Add button for the Keeper Password Manager and Digital Vault Application.
On the General Settings page that comes up next, Enter the Entity ID copied from your Keeper SSO Connect Cloud™ configuration screen to the Server Base URL field. Then select the Done button.
Example Server Base URL: https://keepersecurity.com/api/rest/sso/saml/XXXXXXXX
The value for XXXXXXXX represents the specific SSO Connect instance associated with your enterprise and can be found on the Admin Console SSO configuration as part of the Service Provider information, as seen below:
​
Next, select the Sign On tab.
Scroll down to the SAML 2.0 configuration section, download the Identity Provider metadata file and save the XML file to your computer.
Select OKTA as the IDP Type and upload the metadata xml file into the Keeper SSO Connect interface by browsing to or dragging and dropping the file into the Setup screen:
​
​
If you would like to enable the Single Logout feature in Okta, go to the Sign On tab and click Edit. Click the "Enable Single Logout" checkbox and then upload the SP Cert which comes from the Keeper Admin Console.
Upload the SP cert file and save the Sign On settings in Okta.
Now, download the latest Okta metadata file and upload into Keeper (again).
To enable Okta SCIM user and group provisioning please follow the instructions found within the Enterprise Guide: https://docs.keeper.io/enterprise-guide/user-and-team-provisioning/okta-integration-with-saml-and-scim​
From Okta, you can now add users or groups on the Assignments page. If you have activated SCIM provisioning per the instructions here then the user will be instantly provisioned to Keeper.
​
