Okta

TapPass’s built-in OIDC providers are Google and Azure. For Okta, use the generic SAML 2.0 integration.

SAML setup

1. Create a SAML app in Okta

• Okta admin → Applications → Create App Integration → SAML 2.0
• Single sign-on URL: https://tappass.example.com/saml/acs
• Audience URI (SP Entity ID): https://tappass.example.com/saml/metadata
• Name ID format: EmailAddress

On the Sign On tab, copy the Identity Provider metadata URL (or the IdP SSO URL + X.509 certificate).

2. Configure TapPass

TAPPASS_SAML_ENABLED=1
TAPPASS_SAML_ENTITY_ID=https://tappass.example.com/saml/metadata
TAPPASS_SAML_ACS_URL=https://tappass.example.com/saml/acs
TAPPASS_SAML_IDP_METADATA_URL=https://dev-12345.okta.com/app/<app-id>/sso/saml/metadata
# or pin the IdP directly:
# TAPPASS_SAML_IDP_SSO_URL=https://dev-12345.okta.com/app/<app-id>/sso/saml
# TAPPASS_SAML_IDP_CERT=<base64 X.509 cert>
TAPPASS_SAML_ALLOWED_DOMAINS=yourcompany.com

3. Assign users

Okta → Applications → TapPass → Assignments → Assign to People/Groups.

Group → role mapping

Push Okta groups in the SAML assertion: Sign On → Attributes → Group attribute statements, e.g. name groups, filter Matches regex .*. Then map them to TapPass roles:

TAPPASS_SAML_ROLE_MAPPING="TapPass Admins=admin,TapPass Viewers=viewer"

See the SAML 2.0 page for the full env reference.