I85PREP
⌘ K
Okta Certified Developer study materials
Okta Certified Developer study resources

Okta Certified Developer: Application Integration and SSO

Okta Certified Developer · Work through your exam, one topic at a time.

All guide sections

Application Integration and SSO

This domain covers turning an application into an Okta-integrated app: choosing the protocol, filling in the correct SAML or OIDC settings, assigning users, and pushing lifecycle changes downstream.

Choosing the app type

  • OIDC/OAuth 2.0 for modern web, SPA, native and service apps.
  • SAML 2.0 when the service provider only speaks SAML (legacy SaaS, on-premises).
  • SWA (browser-extension form fill) and Bookmark (link only) provide SSO appearance without a real federation protocol - useful, but not federation.

OIDC app settings that matter

application_type (web, native, browser, service), grant_types, sign-in redirect URIs, post_logout_redirect_uris, initiate login URI (for IdP-initiated entry into the app), consent (TRUSTED vs required), and pkce_required.

SAML settings you must fill

  • ACS URL - the SP endpoint that receives the assertion.
  • Audience URI / SP Entity ID - the SP's identifier; must match the SP's configuration exactly.
  • NameID format - e.g. urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress; unspecified falls back to the Okta username.
  • Attribute statements (user.email, user.firstName) and group attribute statements with a name filter.
  • Okta signs the assertion with its certificate; the SP validates against Okta's IdP metadata. SLO additionally needs the SP's logout URL and certificate.

Assignment and provisioning

Users see an app only after assignment - direct, by group, or via the Everyone group. App user statuses include ACTIVE, PROVISIONED, STAGED and DEPROVISIONED. SCIM 2.0 outbound provisioning pushes creates, updates and deactivations to the app; group push maps Okta groups to app groups; profile mappings translate the universal profile into the app profile.

Worked example

A SAML SP rejects assertions with an audience error. The Audience URI configured in Okta does not equal the SP's Entity ID. Correct the Audience URI, refresh the IdP metadata on the SP side, and retest. A NameID mismatch produces a different symptom ("unknown user"), so check the NameID format and value separately.

Traps

Swapping the ACS URL and Audience URI; expecting SCIM provisioning when only assignment is configured; and forgetting that IdP-initiated assertions carry no InResponseTo.