Skip to main content
Use this guide when you register Planasonix as a SAML 2.0 application in Okta. You need organization admin access in Planasonix and application administrator (or equivalent) rights in Okta.
SSO is an Enterprise feature. Sign-in is SP-initiated: users start at Planasonix, then Okta, then return to the ACS. Read SSO for the overall flow before you follow the steps below.

​
Copy values from Planasonix

Open Settings → SSO in Planasonix and copy:
  • ACS URL (Assertion Consumer Service URL)
  • Entity ID (sometimes called SP Entity ID or Audience URI)
You paste these into Okta when you create the SAML integration. Keep the window open until Okta accepts the values.

​
Create the SAML app in Okta

1

Start a new SAML integration

In the Okta Admin Console, go to Applications → Applications → Create App Integration. Choose SAML 2.0, then continue.
2

Name the application

Enter a clear name (for example, Planasonix) and optional logo. Finish the initial wizard; you configure SAML on the next screen.
3

Configure SAML settings

Under General:
  • Single sign on URL: paste the ACS URL from Planasonix exactly as shown.
  • Audience URI (SP Entity ID): paste the Entity ID from Planasonix exactly as shown.
  • Name ID format: choose EmailAddress unless your Planasonix admin agreed on another format.
Under Advanced Sign-on Settings, enable Response and Assertion signing as your security team requires. Planasonix expects a signed assertion in typical enterprise setups.
4

Save and view setup instructions

Save the SAML configuration. Open Sign On for the app and use View SAML setup instructions or Identity Provider metadata when Planasonix asks for metadata XML or individual endpoints.

​
Attribute mapping

Map Okta profile and group attributes to SAML assertions so Planasonix can identify users and optional group membership.
Use the exact attribute names your Planasonix SSO screen lists under required and optional claims when present.
Pilot with a small Okta group first. Always test login from the Planasonix sign-in page (SP-initiated), not from an Okta app tile.

​
Name ID format

Planasonix usually expects the Name ID to be a stable, unique identifier tied to the user’s email. EmailAddress is the most common choice. If you use a transient or opaque Name ID, confirm with your Planasonix admin that JIT provisioning and user matching are configured for that pattern.
A mismatch between Name ID format in Okta and what Planasonix expects causes intermittent “user not found” or duplicate-account issues after profile changes. Align formats with your implementation owner before production cutover.

​
Finish in Planasonix

Upload Okta’s metadata XML or paste SSO URL, issuer, and X.509 signing certificate into Planasonix. Run a test login from an private/incognito window starting at Planasonix.

SSO overview

ACS, Entity ID, and SP-initiated flow.

Session policy

Session length after Okta login.