Deprecated - Okta Setup

Warning: The options to set up single sign-on (SSO) have changed. Organizations that use SSO will now see a New single sign-on tab on the Authentication settings page in Security and must set up new SSO connections by Oct. 31. This archived guidance for the now-obsolete configuration process will remain available to manage existing connections until the Oct. 31 deadline and will then be removed. For updated guidance to create or migrate SSO connections, see Updated - Single Sign-on Setup.

Your organization may use Okta to securely connect its members to technology. To enable your organization's Blackbaud IDs to sign in to Blackbaud solutions through Okta, create an Okta application and configure its settings on the Authentication settings page in Security and your Okta account.

To prevent inadvertent lockouts:

  • Complete configuration during a maintenance window for your organization's network.

  • Ensure that you have a Blackbaud ID outside of your claimed domains with access to the Authentication settings page.

  1. In Security, select Authentication and then select Manage SSO settings under Single sign-on.

  2. Under Single sign-on, select Use Okta.

  3. Under Configure Okta connection, select Get started or Edit connection.

  4. Enter your organization's name with only alphanumeric characters and dashes (no spaces), and select Next.

  5. In a separate browser tab, sign in to your Okta account as an administrator, and create an application.

    1. In your dashboard, select Admin, Applications, Add Application, and Create New App.

    2. For Sign on method, select SAML 2.0 and Create.

    3. Under General Settings, enter a unique name to identify your application.

    4. For App visibility, select both Do not display application icon to users and ...in the Okta Mobile app.

      Tip: To enable members to easily access Blackbaud solutions, use redirect hints to create bookmark apps for the Okta dashboard or mobile app.

    5. Select Next.

  6. In your Okta dashboard, configure your application's SAML settings:

    1. Under SAML Settings, paste or enter Blackbaud's callback URL — https://blackbaudinc.auth0.com/login/callback — in the Single sign on URL field.

    2. In the Audience URI (SP Entity ID) field, paste or enter your organization's unique audience URI from Authentication.

    3.  Under Attribute Statements, add the names and values used to identify email addresses and names. To add a new statement, select Add Another.

      • For email, enter ${user.email}.

      • For given_name, enter ${user.firstName}.

      • For family_name, enter ${user.lastName}.

    4. Select Next.

    5. Under Feedback, select I'm an Okta customer adding an internal app and This is an internal app that we have created.

    6. Select Finish.

  7. On the Authentication settings page, select Next.

  8. In your Okta dashboard, download your application's certificate.

    1. In Applications, choose your new application and select Sign On.

    2. Under Settings, select View Setup Instructions.

    3. Under X.509 Certificate, select Download certificate.

  9. On the Authentication settings page, enter details about your Okta application.

    1. In the IdP SSO URL field, enter the application's SSO URL.

    2. With a bookmark app, users can sign in to their Blackbaud solution directly from your Okta dashboard. In the IdP-initiated SSO URL field, enter the URL for your Blackbaud solution.

      Tip: Your IdP-initiated SSO URL must use a Blackbaud ID-supported domain, such as blackbaud.com. For more information, see Redirect Settings.

      For information about how to add a bookmark app in Okta, see Deprecated - Okta Bookmarks.

    3. Under Signing certificate, select Choose file, and then browse to and select the certificate downloaded from your Okta account.

  10. To enable members to sign in to Blackbaud solutions through your IdP, assign the application to them in your Okta dashboard.

    1. In Applications, select Assign Applications.

    2. Under Applications, choose the new application.

    3. Under People, choose who should use the application.

    4. Select Next.

    5. Review the assigned people and select Confirm Assignments.

  11. On the Authentication settings page, select Finish.

Tip: For more information about how to set up an Okta application, see Setting Up a SAML Application in Okta.

To properly recognize and redirect members to your IdP when they sign in, identify which email domains your organization uses. For more information, see Claimed Email Domains.

After you set up your Okta connection and claim your email domains, test the connection to verify your organization can now use its IdP to sign in to Blackbaud solutions. For more information, see Test Mode.

After you set up your connection, you can turn on SSO through Okta. When you turn on SSO, anyone who signs in to their Blackbaud ID with one of your claimed domains is redirected to your IdP. After they authenticate through your IdP, their Blackbaud ID:

  • Automatically redirects to your organization's login for future sign-ins

    Tip: By default, members redirect to their Blackbaud ID profile when they sign in through your Okta login. To instead open a different Blackbaud solution, edit the redirect. For more information, see Redirect Settings.

  • Uses your IdP for password updates, lockouts, and similar authentication management

To complete the connection to your IdP, select Learn about connecting SSO and Connect with Okta.

Note: After you enable SSO, resend any pending invitations sent before the connection to Okta.

To clear your setup and start over, select Erase all single sign-on settings. For more information, see Deprecated - Single Sign-on Setup.

If you have issues with your Okta application, see SSO Connection Troubleshooting.