Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Implementing SAML SSO with Okta · mukul975 | DecimalAI

Implementing Saml SSO With Okta

SkillScore14Maintained

implementing-saml-sso-with-okta

Implement SAML 2.0 Single Sign-On (SSO) using Okta as the Identity Provider (IdP). This skill covers end-to-end configuration of SAML authentication flows, attribute mapping, certificate management, a

Securityby mukul975

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

Security & AppSec pack

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/implementing-saml-sso-with-okta/SKILL.md

decimalai skills pull implementing-saml-sso-with-okta --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/implementing-saml-sso-with-okta/SKILL.md https://app.decimal.ai/s/implementing-saml-sso-with-okta/SKILL.md

Raw file: /s/implementing-saml-sso-with-okta/SKILL.md ↗ · machine-readable summary at /s/implementing-saml-sso-with-okta.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

22 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 56d ago

Yes — +9% lift · at higher cost+34% tokens0% turns14% of whole cases pass with skill (3/22)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-03	✗→✓	▲ Improved	—	—
case-01	✗→✓	▲ Improved	—	—
case-17	✓→✓	＝ Same ✓	—	—
case-22	✗→✗	＝ Same ✗	—	—
case-08	✗→✗	＝ Same ✗	—	—

Showing 5 of 22 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 7/30/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

mukul975 / Anthropic-Cybersecurity-Skills

skills/implementing-saml-sso-with-okta/SKILL.md

View on GitHub ↗

License Apache-2.0Imported 8/8/2026Version v1Bundled 6 files · scripts

Skill contents

scripts/

references/

assets/

SKILL.md

Implementing SAML SSO with Okta

Overview

When to Use

When deploying or configuring implementing saml sso with okta capabilities in your environment
When establishing security controls aligned to compliance requirements
When building or improving security architecture for this domain
When conducting security assessments that require this implementation

Prerequisites

Familiarity with identity access management concepts and tools
Access to a test or lab environment for safe execution
Python 3.8+ with required dependencies installed
Appropriate authorization for any testing activities

Objectives

Configure Okta as a SAML 2.0 Identity Provider
Implement SP-initiated and IdP-initiated SSO flows
Map SAML attributes and configure assertion encryption
Enforce SHA-256 signatures and secure certificate rotation
Test SSO flows with SAML tracer tools
Implement Single Logout (SLO) handling

Key Concepts

SAML 2.0 Authentication Flow

SP-Initiated Flow: User accesses Service Provider -> SP generates AuthnRequest -> Redirect to Okta IdP -> User authenticates -> Okta sends SAML Response -> SP validates assertion -> Access granted
IdP-Initiated Flow: User authenticates at Okta -> Selects application -> Okta sends unsolicited SAML Response -> SP validates -> Access granted

Critical Security Requirements

SHA-256 Signatures: All SAML assertions must use SHA-256 (not SHA-1) for digital signatures
Assertion Encryption: Encrypt SAML assertions using AES-256 to protect attribute values in transit
Audience Restriction: Configure audience URI to prevent assertion replay across different SPs
NotBefore/NotOnOrAfter: Enforce time validity windows to prevent stale assertion usage
InResponseTo Validation: Verify assertion corresponds to the original AuthnRequest

Okta Application Configuration

Single Sign-On URL: The ACS (Assertion Consumer Service) endpoint on the SP
Audience URI (SP Entity ID): Unique identifier for the SP
Name ID Format: EmailAddress, Persistent, or Transient
Attribute Statements: Map Okta user profile attributes to SAML assertion attributes
Group Attribute Statements: Include group membership for RBAC

Workflow

Step 1: Create SAML Application in Okta

Navigate to Applications > Create App Integration
Select SAML 2.0 as the sign-on method
Configure General Settings (App Name, Logo)
Set Single Sign-On URL (ACS URL)
Set Audience URI (SP Entity ID)
Configure Name ID Format and Application Username

Step 2: Configure Attribute Mapping

Map user.email to email attribute
Map user.firstName and user.lastName to name attributes
Add group attribute statements for role-based access
Configure attribute value formats (Basic, URI Reference, Unspecified)

Step 3: Download and Install IdP Metadata

Download Okta IdP metadata XML
Extract IdP SSO URL, IdP Entity ID, and X.509 certificate
Install certificate on SP side for signature validation
Configure SP metadata with ACS URL and Entity ID

Step 4: Implement SP-Side SAML Processing

Parse and validate SAML Response XML
Verify digital signature using IdP certificate
Check audience restriction, time conditions, and InResponseTo
Extract authenticated user identity and attributes
Create application session based on assertion data

Step 5: Security Hardening

Enforce SHA-256 for all signature operations
Enable assertion encryption with AES-256-CBC
Configure session timeout and re-authentication policies
Implement SAML artifact binding for sensitive deployments
Set up certificate rotation procedure before expiry

Step 6: Testing and Validation

Use SAML Tracer browser extension for debugging
Validate SP-initiated and IdP-initiated flows
Test with multiple user accounts and group memberships
Verify SLO functionality
Test certificate rotation without downtime

Security Controls

| Control | NIST 800-53 | Description | |---------|-------------|-------------| | Authentication | IA-2 | Multi-factor authentication through Okta | | Session Management | SC-23 | SAML session lifetime controls | | Audit Logging | AU-3 | Log all SSO authentication events | | Certificate Management | SC-17 | PKI certificate lifecycle management | | Access Enforcement | AC-3 | SAML attribute-based access control |

Common Pitfalls

Using SHA-1 instead of SHA-256 for SAML signatures
Not validating InResponseTo in SAML responses (replay attacks)
Clock skew between IdP and SP causing assertion rejection
Failing to restrict audience URI allowing assertion forwarding
Not implementing certificate rotation before expiry causes outage

Verification

] SAML SSO login completes successfully via SP-initiated flow
] IdP-initiated flow correctly authenticates users
] SAML assertions use SHA-256 signatures
] Attribute mapping correctly populates user profile
] Session timeout forces re-authentication
] SLO properly terminates sessions on both IdP and SP
] Certificate rotation tested without service interruption

Illustrative Want to see what implementing-saml-sso-with-okta would put in front of your model? Preview the rendered body and check its trigger phrases — no LLM call, no signup.

Latest benchmark · publisher runVerified

7/28/2026, 09:53 UTC · 22 cases

Lift

+9%

14% vs 5%

Agent turns

1.0 vs 1.0

Tokens

+34%

2,907.32 vs 2,172.73

fail → pass · 2pass → pass · 1fail → fail · 19

Per-case results (22)

Case	Status	Duration (ms)			Turns			Tokens			Tool calls
Case	Status	Without	With	Δ	Without	With	Δ	Without	With	Δ	Without	With	Δ
case-22 We are configuring SAML 2.0 SSO for an enterprise app using Microsoft Entra ID (formerly Azure AD) as our Identity Provider. Where in the Entra ID admin center do we configure Enterprise Applications and download the Azure SAML Federation Metadata XML?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-08 Our Service Provider needs to assign internal application roles based on Okta user groups. How should group memberships be passed in the SAML assertion from Okta?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-20 We are building a single-page React application and native mobile app connecting to Okta. We plan to use OpenID Connect (OIDC) with Authorization Code Flow and PKCE. How should we configure the grant types and token exchange in Okta?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-14 In Okta's SAML 2.0 App Integration setup wizard, we are asked for 'Single Sign-On URL' and 'Audience URI'. What do these two fields correspond to on the Service Provider side?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-19 Which NIST 800-53 control code applies to logging all SAML SSO authentication events across Okta and SP?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-21 We want to automate real-time user lifecycle provisioning (creating, updating, and deactivating accounts) from Okta to our SaaS portal REST API using SCIM 2.0 protocol endpoints. What REST endpoints and payload structures are required for SCIM 2.0 integration?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-06 Users occasionally receive authentication errors when logging into our SP via Okta during peak traffic, with logs pointing to assertion timestamp checks. What specific SAML assertion time condition elements must be validated, and how should clock skew be handled?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-12 Our architecture team wants to understand the exact flow when a user navigates directly to our application's login page versus clicking an app icon inside Okta. Outline the sequence of messages for an SP-initiated SAML flow.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-11 We are deploying a high-security financial application where SAML assertions containing sensitive PII must avoid being exposed through user browser redirects or POST bodies. What SAML binding option should be implemented?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-18 For NIST 800-53 compliance audit reporting on our Okta SAML implementation, which specific control family identifier covers PKI certificate lifecycle management?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-07 We need to set up attribute mapping in Okta SAML application settings for standard user profile details so our Service Provider can automatically provision local profile fields upon first login. How should standard profile attributes like email and full name be mapped?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-09 Our Okta IdP signing certificate is set to expire in 30 days. Our operations team plans to wait until the exact day of expiration to replace the certificate on both Okta and the SP simultaneously during a scheduled maintenance window. What is the recommended strategy for certificate rotation?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-03 Our team believes HTTPS/TLS transport security is sufficient for SAML responses sent from Okta to our Service Provider, so we plan to disable SAML assertion encryption to reduce CPU processing overhead. Should we leave assertions unencrypted?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-15 When configuring Okta SAML app integration, what Name ID formats are standard for identifying users across enterprise applications?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-02 We are configuring a legacy SAML SP integration with Okta. The SP vendor documentation suggests keeping the default signature algorithm setting, which defaults to SHA-1 for backwards compatibility. Is SHA-1 acceptable or should we enforce SHA-256?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-01 We are connecting our internal enterprise web app to Okta for authentication via SAML 2.0. Can you guide me through the setup steps required on both the Okta side and our service provider application, including attribute mapping and how to handle response validation?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-04 When validating SAML assertions on our Service Provider, our developer checked the digital signature and verified the NotOnOrAfter timestamp, but omitted checking the InResponseTo field because our app is stateless. Is omitting InResponseTo validation safe?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-05 We have multiple internal SP applications behind Okta. To simplify setup, we are considering using a generic wildcard or omitting Audience URI (Entity ID) checks during SP assertion validation. What is the risk and required configuration?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-10 When a user clicks 'Log Out' inside our Service Provider application, destroying the local SP session cookie ends their session. Is this single-sided logout sufficient for SAML SSO with Okta, or is additional configuration needed?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-13 Our team is troubleshooting a failed SAML assertion validation error where Okta returns success but the SP rejects the response. What tool and methodology should we use to inspect the SAML payload during execution?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-16 What components must be extracted from the Okta IdP metadata XML file and configured on the Service Provider side to establish SAML trust?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-17 We are preparing compliance documentation for NIST SP 800-53 controls for our SAML SSO setup. Which control identifier corresponds to SAML session lifetime management and session controls?	pass→pass	—	—	—	—	—	—	—	—	—	—	—	—

These cases were also screened by the skill’s intent / safety pass.See the Trust review ↗Reproduce this benchmark in Colab ↗

How this skill was measured

DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 22 cases were attempted. The headline lift of +9 percentage points is the difference between those two pass rates over the 22 comparable cases.

Model measured: gemini-3.6-flash
Graded by: gemini-3.6-flash
Grading method: judged
Verification: verified
Pass rate without the skill: 4.6%
Pass rate with the skill: 13.6%
Cases attempted: 22
Cases counted toward lift: 22
Cases that regressed: 0
Skill version measured: v1
Run completed: 7/28/2026, 09:53 UTC

The per-case answers from this run were removed by the retention sweep, so the case table below shows the verdicts without the text either arm produced. The counts above were recorded at the time and are unaffected. Answers are now kept for 180 days.

SkillScore blends 4 signals1 of 4 complete

BenchmarkPass rate WITH skill on a verified run14

Live evalNeeds ≥10 evaluated traces in 30 days

AI ratingNeeds ≥10 rated traces

AdoptionNeeds ≥10 serves across ≥2 orgs in 30 days

Efficiency · separate axis (at equal correctness)+0% turns+16% tokens

Shown for transparency; not credited unless a verified run shows no correctness regression.

Backed by 1 of 4 signals — each added signal makes the score more robust.

Verified on gemini-3.6-flash · re-tested 55 days ago

Other measured skills in the registry, with their headline benchmark lift.