How to set up Okta SAML SSO for Chili Piper

In this article, we will walk through the required steps to integrate Okta SAML SSO with Chili Piper.

• You must be a Chili Piper admin to enable Single Sign-On (SSO).
• You must use the same email address for both Chili Piper and Okta.
• This feature is currently in the Beta version.
• This article is dedicated to Chili Piper users who have already been upgraded to the Demand Conversion Platform. If you are still a Legacy user, check this article instead.
• You can find Chili Piper on Okta's Integrations page for more details here.

How to configure Okta SAML SSO

Before configuring Okta in Chili Piper itself, you must add Chili Piper as an app in Okta:

1. Select Add Application.
2. Select Browse App Catalog.
3. Search for the Chili Piper application.
4. Select the Add button for the Chili Piper application.
5. In General Settings select the appropriate values for:
   1. Application Visibility: If you want to temporarily hide the app while configuring, select the check box next to Do not display application icon to users. (You will need to change this after configuration to make the app visible to your users.)
   2. Browser plugin auto-submit
   3. In SAML Settings, ensure the Attribute Statements include the following entries:
      1. Name: firstName | Value: user.firstName
      2. Name: lastName | Value: user.lastName
      3. Name: email | Value: user.email
         
6. Select Next.
7. Under Sign On Methods, select SAML 2.0.
8. Select View Setup Instructions
9. Leave this tab open and proceed to the Chili Piper app to complete setup.

Recommended: Send a Stable, Immutable NameID

Important: In Okta, the NameID value is driven by the Application username field, not by a "NameID" field. Name ID format only sets the format (Unspecified, EmailAddress, Persistent, and so on) — the value always comes from Application username.

Custom SAML Apps

If you configured Chili Piper as a custom SAML app, you control both fields:

1. Go to Admin Console > Applications > Create App Integration > SAML 2.0 > Configure SAML.
2. Set Application username to Custom and enter an Okta Expression Language expression that resolves to a stable attribute, such as the immutable Okta user ID (user.id).
3. Optionally, set Name ID format to Persistent.

Okta App Catalog (OIN) Integrations

If you added Chili Piper from the Okta App Catalog (OIN), the SAML configuration, including Name ID format, is preconfigured by the integration publisher and is usually not editable in the admin UI. You can still send a stable identifier by setting Application username on the app's Sign On > Credentials > Details, often using a Custom expression that resolves to the immutable Okta user ID.

For more information, see Okta's SAML application configuration reference and Configuring a custom username format for SAML applications.

Integrating Okta SAML SSO in Chili Piper

1. Access Okta SAML Configuration by clicking Integrations in the right-side menu and click the Security tab. Then, click Connect on the Okta card.
    

2. Copy and Paste the Default ACS URL and the Entity ID from Chili Piper into Okta. These URLS cannot be edited in anyway or they will not work.
   Once done, click Confirm Posting on Identity Provider

   
   
    

3. Copy and Paste Metadata URL (located under the Sign-On tab) from Okta into Chili Piper & Test Connection
   
   
    
4. Paste it to the Metadata URL field in Chili Piper in Step 2 section of the Okta setup.
   
    
5. Click Test Connection and you will be directed to the Okta login screen. You must log into Okta using the same credentials that you are logged into Chili Piper.
   
   If the Connection is successful, you will be redirected back to Chili Piper to enforce SSO for all users.
    
6. Optionally, if you’d like to enforce your users only logging in via Okta, you can opt to do this now. This option will only be available if testing the connection in Step 2 was successful.
   
    

Okta SAML SSO Features

• SP login flow (Service-provider Initiated)
  • Users can log in via fire.chiliipiper.com, and your Identity provider will authenticate the user.
• Identity Provider Initiated SSO (IdP-initiated)
  • Users can log in to their identity provider and select the Chili Piper app.
  • Only available if your identity provider supports a Default Relay State.
• JIT provisioning is not supported.

Things to Know

• SAML Attributes include:
  • firstName: user.firstName
  • lastName: user.lastName
  • email: user.email

Reference file: how-to-set-up-okta-saml-sso-for-chili-piper.md (https://help.chilipiper.com/hc/article_attachments/53436208159379)