Aug 13: Context layer webinar
Chalk home page
  1. Security
  2. Okta SAML

Chalk supports standard SSO providers such as Google and GitHub for SSO authentication. Companies that use Okta need additional configuration.

​
Supported features

  • IdP-initiated Single Sign-On, initiated via Okta
  • SP-initiated Single Sign-On, initiated from Chalk
  • Push group and user provisioning via SCIM, initiated from Okta

For details about Chalk’s authentication capabilities, see SSO and SAML.

​
Customers with self-hosted web dashboards

For customers whose self-hosted deployments include a full API server and frontend deployment via helm, this page covers only part of the SAML setup. After completing this guide, refer to the Cloud Auth documentation to complete setup.

If your Chalk web dashboard is not https://chalk.ai, check your team’s dashboard for the correct values. These can be found under Single Sign-On in the team settings:

  • Single Sign-On URL: This should start with your custom URL and not chalk.ai, but retain the same URL path.
  • Audience URI: This should start with your custom URL and not chalk.ai.
  • Chalk’s SAML Certificate is regenerated for each custom web dashboard. If your team did not generate this themselves, contact Chalk for support.

​
Setup steps

All details and controls are on your team’s Single Sign-On page, under the team settings.

​
Set up an Okta SAML application

  1. Navigate to your Okta admin dashboard
  2. Choose “Create App Integration”
    • Choose “SAML 2.0” for “Sign-in Method”
    • Choose “Web Application” for “Application type”
  3. General Settings
    • Name this application (“Chalk”, for example)
    • Upload the Chalk logo (download here).
  4. Configure SAML
    • Single sign on URL: https://chalk.ai/api/auth/login/saml
    • Make sure that “Use this for the Recipient URL and Destination URL” is checked
    • Audience URI: https://chalk.ai/api/saml/metadata.xml
    • Default RelayState: Leave blank
    • Name ID Format: Unspecified
    • Application username: Email
    • Update application username: Create and update
    • Show advanced settings
    • Change “Assertion Encryption” to Encrypted
    • Upload Chalk’s SAML certificate (download here)
    • Attribute Statements
      • given_name
        • Name format: unspecified
        • Value: user.firstName
      • last_name
        • Name format: unspecified
        • Value: user.lastName
  5. Feedback
    • Check “I’m an Okta customer adding an internal app”
  6. Click “View SAML Setup Instructions”. Record the following for the next step:
    • Identity Provider Single Sign-On URL
    • Identity Provider Issuer
    • X.509 certificate

​
Connect Chalk to your SAML application

You can connect your Okta application with Chalk from Single Sign-On in the team settings. In the SAML Configurations section, select Add configuration. To integrate your SAML application with Chalk, submit the following details from the previous section:

  • Issuer: The Okta Identity Provider Issuer.
  • Login URL: The Okta Identity Provider Single Sign-On URL.
  • Logout URL: Also the Okta Identity Provider Single Sign-On URL.
  • Certificate: The Okta X.509 certificate.

​
Next steps

After you verify that you can log in to Chalk from your Okta application, you can: