How to Configure SAML 2.0 for Dynamic Signal

Contents

• Supported Features
• Configuration Steps
• Notes

---

Supported Features

The Okta/Dynamic Signal SAML integration currently supports the following features:

• IdP-initiated SSO
• SP-initiated SSO
• JIT (Just In Time) Provisioning

For more information on the listed features, visit the Okta Glossary.

---

Configuration Steps

1. Log in to your Dynamic Signal instance as an administrator.

2. Navigate to Admin > Registration > Single Sign-On:

   

3. Enable SSO: Check this box.

4. Note the Service Provider Issuer value.

5. Identity Provider Certificate: Copy and paste the following:

   Sign into the Okta Admin Dashboard to generate this variable.

6. Identity Provider Service URL: Copy and paste the following:

   Sign into the Okta Admin dashboard to generate this value.

7. Service Binding: Select POST.

8. Logout URL: Copy and paste the following:

   Sign into the Okta Admin Dashboard to generate this variable.



9. Signature Algorithm: Select SHA-256

10. ID and Email Settings: Select the required value. By default Email Required as User ID is used.

    Important: Do not select any option contains External SSO User ID if you have added users in Dynamic Signal manually. This will prevent user login to Dynamic Signal. We recommend using this option for users created using SCIM functionality only.

11. Attribute Map: Enter the following attribute names:

    • Email: Email

    • First Name: FirstName

    • Last Name: LastName

    Note: If you are using ID and Email Settings (step 10) contains External SSO User ID, enter the following External SSO User ID attribute name: ExternalSsoUserId:

    

12. Click Save:

    

13. [OPTIONAL] If you are going to allow your users to login using username/password:

    • Navigate to Admin > Registration > Registration settings.

    • Select the Email Address option.

    

14. Done!

---

Notes

• Make sure that you entered the correct value in the Base URL field under the General application tab in Okta. Using the wrong value will prevent you from authenticating via SAML to Dynamic Signal. The Base URL value is equal to the Service Provider Issuer (step 4).

• The following SAML attributes are supported:

  Name	Value
  FirstName	user.firstName
  LastName	user.lastName
  Email	user.email
  ExternalSsoUserId	user.id

SP-initiated SSO

OPTION A: Email/password authentication allowed.

1. Open your base URL value.

2. Click Sign in with SSO:

OPTION B: Email/password authentication NOT allowed.

Open your base URL value.