SSO: Configuring Okta for Use with InVision V7 V7

Getting set up to use Okta with InVision V7 involves four primary tasks:

1. Add InVision as a new application in Okta
2. Add your users to the application
3. Download the metadata for the application
4. Configure Okta in InVision

Adding InVision as a new application in Okta

To add the InVision app in Okta:

1. Sign in to Okta as an admin.
2. In the sidebar, navigate to Applications.
3. Click Browse App Catalog.

   

4. In the search bar at the top, look up "InVision"
5. Select the InVision app.

   

6. Click Add.

   

7. On the following General Settings page, enter your InVision subdomain in the Subdomain field and click Done.

   

Add your users to the application

Under the Assignments tab, click the Assign button to assign people or groups who should be able to access InVision. If you don't add them, they won't be able to access InVision via Okta.

Be sure to verify that the email addresses in Okta match those for existing InVision accounts.

Download the metadata for the application

To download the metadata:

1. Click the Sign On tab.
2. Click the Identity Provider metadata link.

   This will open a new window with a XML file containing the metadata. This file includes information you will need to fill out when configuring Okta in InVision (i.e. sign-in URL, SAML certificate)

   

Configuring Okta in InVision

With InVision V7, you can configure Okta directly from your team settings.

To perform this action, you must be an owner or admin on the Enterprise account.

To configure Okta:

1. Sign in to your InVision Enterprise here:your-team-name.invisionapp.com
2. In the lower-left corner, click the [Your Team Name] dropdown and open the Settings page.
3. Click Single sign-on.

   

4. Toggle on Require SSO for every member of [your Enterprise team]

   

5. With the information provided in Okta’s Identity Provider metadata file, fill out the SSO settings page: 
   • Name: Set any name you want for the configuration.
   • Sign-in URL: Use the URL provided at the end of the metadata file in the SingleSignOnService attribute.
   • Sign-out URL: Okta does not support SLO, so leave this blank.
   • SAML Certification: Copy the certification provided in the ds:X509Certificate attribute of the metadata file.
   • Name ID Format: urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress
   • HASH Algorithm: SHA-256
   • SSO Button Label: Set any text you’d like for the SSO button that appears when signing in.
6. Click Update.

   

Going forward, any user that attempts to sign in to your InVision V7 subdomain will be prompted to use SSO with Okta.