> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/web-application-and-api-protection-waap-protection-protection/settings/configuration/teams/saml/set-up-saml-group-mapping-with-okta.md).

# Set Up SAML Group Mapping with Okta

You can configure SAML-based Single Sign-On (SSO) with Okta and map Okta groups to Traceable roles, so that Traceable automatically assigns roles to users based on their Okta group membership. This topic is intended for administrators who configure Traceable as a SAML service provider with Okta as the identity provider.

***

## Before you begin

Make a note of the following before you configure SAML group mapping:

* Make sure that you have admin access to your Okta tenant.
* Make sure that the Traceable application is added to your Okta instance.
* Make sure that the group names for your different sets of users are defined in Okta.
* You must have admin access to the Traceable UI to configure the SAML group attribute and role mapping.

***

## Configure SAML group mapping with Okta

The configuration process requires switching between Okta and Traceable. To configure SAML group mapping, complete the following steps:

### Step 1: Configure the Okta application

In this step, you add a group attribute to the Traceable application in Okta, so that the SAML assertion sent to Traceable includes group data.

1. In the Okta Admin Console, navigate to **Applications** → **Applications**.
2. Click the **Traceable** application.
3. Click the **General** tab.
4. In the **SAML Settings** section, click **Edit**.
5. Proceed through the wizard until you reach **Attribute Statements** (Optional).
6. Add a new attribute with the following values:
   * **Name**: `groups`
   * **Name format**: Unspecified
   * **Filter**: Select one of the following:
     * **Starts with**: Sends only the groups that begin with a specific prefix, for example, `Traceable`.
     * **Equals**: Sends a specific group.
7. Click **Next**, and then click **Finish**.

### Step 2: Test and extract the group attribute name

In this step, you verify that the SAML response includes the group information, and note the attribute name and group values.

1. In Okta, click the **Sign On** tab of the Traceable application.
2. Scroll to the **SAML Signing Certificates** section.
3. Click **View Setup Instructions**, or use a tool such as SAML-tracer to test the login flow.
4. Verify that the decoded SAML response includes the group information. For example:

   ```xml
   <Attribute Name="groups">
     <AttributeValue>Dev Team</AttributeValue>
   </Attribute>
   ```
5. Note the group attribute name, `groups`, and the group values, such as `Dev Team`. You need these values in the next step.

### Step 3: Map groups to roles in Traceable

In this step, you enter the group attribute name in Traceable and map each Okta group to a Traceable role.

1. In Traceable, navigate to **Configuration** → **Team**, and click the **SAML Config** tab.
2. In the **Group Attribute Name** field, enter `groups`.
3. Click **+ Add Group**, and specify the following:
   * **SAML Group**: The group value, for example, `Dev Team`.
   * **Role**: The Traceable role to assign, for example, **Developer**.
   * **Scope**: Whether the role applies globally or to a specific application or project.
4. Click **Add Role**, and then click **Save**.

***

## Next steps

After you complete the setup, Traceable assigns roles to users who log in through Okta SSO based on their group membership. You can edit or remove group-role mappings at any time in Traceable.

For more information on completing the SAML configuration process, see [SAML Configuration](/web-application-and-api-protection-waap-protection-protection/settings/configuration/teams/saml/saml-configuration.md).

{% @harness-feedback/feedback %}