Revspire Resources

Okta Connection

Connect Revspire to Okta for SAML 2.0 single sign-on. Start with optional SSO and one pre-provisioned test user.

Before You Start

  • Okta administrator access.
  • An active Revspire Deal Room entitlement and access to Revspire > Setup > SSO.
  • View SSO Settings, View SAML SP Certificate, and Create SSO Providers permissions.
  • An active, licensed Revspire test user with a username or email that will match the Okta attribute mapping.

Step 1: Copy Revspire SP Values

In Revspire > Setup > SSO, copy these values from the SAML endpoint panel:

ACS URL = <copy from Revspire>
SP Entity ID = <copy from Revspire>
SP Signing Certificate = <download or copy from Revspire>
SP Cert SHA256 Fingerprint = <copy from Revspire>

Do not configure the Revspire SP Login URL or SP Logout URL as Okta SAML endpoints.

Step 2: Create the Okta SAML Integration

Path: Okta Admin Console > Applications > Applications > Create App Integration > Classic experience > SAML 2.0

Okta Field Label: App name
Value: Revspire

Okta Field Label: Single sign-on URL
Value: <Revspire ACS URL>

Okta Field Label: Use this for Recipient URL and Destination URL
Value: selected

Okta Field Label: Audience URI (SP Entity ID)
Value: <Revspire SP Entity ID>

Okta Field Label: Default RelayState
Value: leave blank

Okta Field Label: Name ID format
Value: Persistent

Okta Field Label: Application username format
Value: Custom

Custom expression:
user.getInternalProperty("id")

Okta Field Label: Update application username on
Value: Create only

The custom application username gives Revspire a stable Okta user identifier as NameID. If your Okta policy does not permit that expression, use another immutable, non-reassigned user identifier. Do not use a changeable or recycled email address as the long-term NameID.

Some older Okta tenants do not show Classic experience. Use the equivalent SAML 2.0 app wizard in that tenant while preserving the values and signing requirements below.

Step 3: Add Bootstrap Attribute Statements

Attribute Name: revspire_username
Name format: Unspecified
Value: user.login

Attribute Name: email
Name format: Unspecified
Value: user.email

One canonical mapped value is sufficient and must exactly and uniquely match the existing Revspire user on first login. If you send both mappings, they must resolve to the same user.

Step 4: Configure Signing

Open the advanced SAML settings in the Okta integration and apply:

Response = Signed
Assertion Signature = Signed
Signature Algorithm = RSA-SHA256
Digest Algorithm = SHA256
Assertion Encryption = Unencrypted

Revspire requires both the SAML Response and Assertion signatures. Where Okta offers signed-request verification, upload the Revspire SP signing certificate and confirm its SHA-256 fingerprint.

Step 5: Copy Okta IdP Values

From the Okta Sign On tab or SAML setup instructions, copy:

Identity Provider Issuer = <paste into Revspire Issuer Entity ID>
Identity Provider Single Sign-On URL = <paste into Revspire SSO URL>
X.509 Certificate = <paste the active Okta signing certificate in PEM format>
IdP Single Logout endpoint = <optional; only if Okta supplies it>

Step 6: Add the Okta Provider in Revspire

Path: Revspire > Setup > SSO > Add

Provider Type = Okta
Provider Display Name = Okta
Issuer Entity ID = <Identity Provider Issuer>
SSO URL (IdP Login URL) = <Identity Provider Single Sign-On URL>
IdP SLO URL (Optional) = <Okta IdP logout endpoint, if supplied>
X.509 Certificate = <active Okta signing certificate>
Set as Primary Provider = enabled for the controlled login test when this is not the first provider

The first provider becomes primary automatically. When multiple providers exist, only the primary provider handles normal Revspire-initiated login.

Do not paste the Revspire SP Logout URL into Okta. Revspire completes local logout first and can send a best-effort LogoutRequest to the optional Okta IdP SLO endpoint.

Step 7: Assign and Test

  1. Assign one pre-provisioned user to the Revspire application in Okta.
  2. Start at the Revspire login page, resolve the account, and click Sign In with SSO.
  3. Confirm the user is matched once, then test a second user and logout.
  4. Keep SSO optional until the tests succeed. Enable SSO-only only after validating an administrator recovery path.

Certificate Rollover

Before Okta activates a new application signing certificate, add it in the selected Revspire provider’s certificate settings. Verify the fingerprint, test login after Okta switches, and then deactivate the old certificate.

Troubleshooting

  • User not found: confirm revspire_username or email exactly matches one active, licensed Revspire user.
  • Ambiguous identity: remove duplicate usernames or emails; Revspire will not choose one duplicate automatically.
  • Signature validation: confirm both signing options and that Revspire has Okta’s current active certificate.
  • Unsolicited response: start from Revspire rather than an Okta tile; IdP-initiated login is disabled by default.

For lifecycle provisioning, continue with Okta SCIM Provisioning.