--- title: "SAML integration" slug: "okta-integration" description: "Learn to configure Okta SAML Single Sign-On for ScreenMeet with step-by-step instructions for seamless integration and user access management." updated: 2026-08-07T18:39:37Z published: 2026-08-07T18:39:37Z canonical: "docs.screenmeet.com/okta-integration" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.screenmeet.com/llms.txt > Use this file to discover all available pages before exploring further. # Okta Integration ## Configure Okta SAML Single Sign-On for ScreenMeet ### Overview This article explains how to configure Okta as a SAML identity provider for the ScreenMeet Agent Portal. It is written for Okta administrators who are setting up ScreenMeet single sign-on for the first time. Configuration happens in two places. You complete the Okta side yourself, then send three values to ScreenMeet Support so a SAMLConnector can be created for your organization. Single sign-on does not function until both sides are in place. --- ### Prerequisites - Administrator access to your Okta tenant - The ScreenMeet SAML encryption certificate, `screenmeet.cert`, available from ScreenMeet Support --- ### Step 1: Install the ScreenMeet Okta application 1. Sign in to your Okta Admin Console as an administrator. 2. Go to **Applications** and then **Browse App Catalog**. 3. Search for **ScreenMeet** and select the ScreenMeet integration. 4. Click **Add Integration**, then click **Done** on the General Settings screen. Install From the App CatalogInstall ScreenMeet from the Okta Integration Network catalog. A cloned application or a custom SAML 2.0 application carries different defaults and will not authenticate correctly. --- ### Step 2: Upload the ScreenMeet encryption certificate The Okta application requires a service provider encryption certificate before it can build a SAML assertion for ScreenMeet. Without it, single sign-on fails at Okta with a `400 Bad Request` error. 1. Go to **Applications**, select **ScreenMeet**, and open the **Sign On** tab. 2. Click **Edit** in the Settings section. 3. Locate the **Encryption Certificate** field and click **Browse**. 4. Select `screenmeet.cert`, then click **Upload**. 5. Confirm the field displays `screenmeet.cert (CN=*.screenmeet.com)`. Certificate SourceThe ScreenMeet encryption certificate is a wildcard certificate issued for `*.screenmeet.com`. The same certificate applies to every ScreenMeet customer. Request it from ScreenMeet Support if you do not already have it. --- ### Step 3: Configure the Roles attribute The Okta application must be configured to pass a role value in the SAML assertion. Leave this set to **None** and single sign-on will fail even when the encryption certificate is present. 1. In the same **Sign On** edit view, locate the **Roles** field. 2. Open the dropdown and select **Matches Regex**. 3. In the adjacent text field, enter `.*` without quotation marks. 4. Click **Save**. Both Settings Are RequiredThe encryption certificate and the Roles regex are both mandatory. Applying only one of the two will not resolve the `400 Bad Request` error at sign-in. --- ### Step 4: Create groups and assign the application Assign the ScreenMeet application to Okta groups rather than to individual users. With group-based assignment, adding a user to a group grants ScreenMeet access automatically, with no per-user assignment step. #### Create the groups Go to **Directory**, then **Groups**, and create the following groups. | Group | Purpose | Naming requirement | | --- | --- | --- | | `OrgAdmin` | Administrators who manage ScreenMeet settings and can view and edit other users | Exact name required | | `Supervisor` | Users who can view other users in the organization | Exact name required | | Agent group, for example `SM Agents` | Standard agents who need ScreenMeet access without elevated permissions | Any name | Group Names and PermissionsScreenMeet reads the `OrgAdmin` and `Supervisor` group names from the SAML assertion to grant elevated permissions in the Agent Portal. The agent group name carries no special meaning to ScreenMeet; it exists only to manage application assignment in Okta. #### Assign the application to the groups 1. Open the **Assignments** tab on the ScreenMeet application. 2. Click **Assign** and select **Assign to Groups**. 3. Assign the application to `OrgAdmin`, `Supervisor`, and your agent group. #### Provision users Add each administrator to the `OrgAdmin` group. Add standard agents to your agent group, either individually or through automation. - **Manual**: Open the group in **Directory**, then **Groups**, and add members directly. - **Automated**: Use Okta group rules (**Directory**, **Groups**, **Rules**) or an existing directory integration to place users into the group automatically based on attributes such as department or title. Scaling User ProvisioningGroup rules keep provisioning hands-off as your team grows. A rule that places all users in a support department into your agent group means new hires receive ScreenMeet access with no manual step. A user who is not assigned the application, directly or through a group, generates an unauthorized access failure in the Okta System Log when they click the ScreenMeet tile. --- ### Step 5: Send your identity provider values to ScreenMeet 1. Go to **Applications**, select **ScreenMeet**, open the **Sign On** tab, and click **View SAML setup instructions**. 2. Record the **Identity Provider Single Sign-On URL**, the **Identity Provider Issuer**, and the **X.509 Certificate**. 3. Email all three values, along with the name of your organization, to [support@screenmeet.com](mailto:support@screenmeet.com). ScreenMeet creates a SAMLConnector that accepts authentication requests from your Okta tenant. Sign-in attempts fail until this is complete. Certificate RotationIf you generate a new SAML signing certificate in Okta at any point, send the replacement X.509 Certificate to ScreenMeet Support. The SAMLConnector continues to trust the previous certificate until it is updated, and all sign-in attempts will fail. --- ### Step 6: Grant elevated permissions Elevated permissions in the Agent Portal come from membership in the `OrgAdmin` and `Supervisor` groups created in Step 4. Add users who need those permissions to the appropriate group. | Group name | Permission granted | | --- | --- | | `OrgAdmin` | Can view and edit other users in the organization | | `Supervisor` | Can view other users in the organization | Permission Changes Require a New SessionUsers must sign out of ScreenMeet and sign back in before permission changes from group membership appear in the Agent Portal. --- ### Verification 1. Open a private browsing window and sign in to your Okta portal as an assigned user. 2. Confirm the ScreenMeet tile appears on the dashboard. 3. Click the tile and confirm you reach the ScreenMeet Agent Portal without an error page. 4. For a user in the `OrgAdmin` or `Supervisor` group, confirm the additional portal functionality is present. --- ### Troubleshooting #### 400 Bad Request at sign-in Okta cannot build the SAML assertion for ScreenMeet. Confirm the encryption certificate is uploaded (Step 2) and the **Roles** field is set to **Matches Regex** with a value of `.*` (Step 3). Both settings must be in place. #### Unauthorized access failure in the Okta System Log The user is not assigned the ScreenMeet application. Add the user to a group that has the application assigned, or assign the application to the user directly (Step 4). #### Sign-in fails for all users after previously working A new SAML signing certificate was likely generated in Okta. Send the current X.509 Certificate to [support@screenmeet.com](mailto:support@screenmeet.com) so the SAMLConnector can be updated (Step 5). #### Elevated permissions do not appear Confirm the user is in the `OrgAdmin` or `Supervisor` group with the exact group name, then have the user sign out of ScreenMeet and sign back in (Step 6). --- ### Related Articles - [ScreenMeet Agent Portal overview](/docs/okta-integration#) - [SAML single sign-on troubleshooting for ScreenMeet](/docs/okta-integration#)