> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/web-application-and-api-protection-waap/settings/configuration/teams/saml/set-up-saml-group-mapping-with-okta.md).

# Set Up SAML Group Mapping with Okta

This topic explains how to configure SAML-based Single Sign-On (SSO) with Okta and set up group mapping so that Traceable can automatically assign user roles based on their Okta group membership.

This guide is intended for administrators configuring Traceable as a SAML service provider using Okta as the identity provider.

***

## Before You Begin

Ensure you have the following:

* Admin access to your Okta tenant.
* The Traceable application has already been added to your Okta instance.
* Group names are already defined in Okta for different sets of users.
* Admin access to the Traceable UI to configure the SAML Group Attribute and role mapping.

***

## Step 1: Configure the Okta Application

1. In the Okta Admin Console, go to **Applications → Applications**
2. Locate and click the **Traceable** application
3. Open the **General** tab
4. Scroll down to the SAML Settings section and click **Edit**
5. Proceed through the wizard until you reach **Attribute Statements** (Optional)
6. Add a new attribute to include group information:
   * Name: `groups`
   * Name format: Unspecified
   * Filter: Choose either:
     * Starts with (e.g., `Traceable`) — to send only groups that begin with a particular prefix
     * Or, Equals — to send a specific group
   * Click **Next**, then **Finish**.

This step ensures that group data is included in the SAML assertion sent to Traceable.

***

## Step 2: Test and Extract the Group Attribute Name

1. Go to the **Sign On** tab of the Traceable app in Okta.
2. Scroll to the **SAML Signing Certificates** section.
3. Click **View Setup Instructions** or use a tool like SAML-tracer to test the login flow.
4. Check the decoded SAML response and verify that the group information is included:

   ```language-xml
   <Attribute Name="groups">
     <AttributeValue>Dev Team</AttributeValue>
   </Attribute>
   ```

Note down `groups` as the Group Attribute Name and values such as `Dev Team` as group values.

***

## Step 3: Map Groups to Roles in Traceable

1. In the **Traceable UI**, go to **Configuration → Team**
2. Click the **SAML Config** tab
3. In the Group Attribute Name field, enter `groups`
4. Click **+ Add Group** to define role mappings:
   * **SAML Group**: Enter a group value like `Dev Team`
   * **Role**: Select the appropriate Traceable role (e.g., Developer)
   * **Scope**: Define whether the role applies globally or to a specific app/project
5. Click **Add Role**, then **Save**.

***

## What’s Next?

After setup:

* Users logging in via Okta SSO will automatically receive roles based on group membership
* You can edit or remove group-role mappings anytime in the Traceable UI

Return to the [SAML Configuration](/web-application-and-api-protection-waap/settings/configuration/teams/saml/saml-configuration.md) topic to continue with the rest of the SAML configuration process.