Skip to content

Choose your language

  • No results

Choose your login

  • No results
Support
Search

Configuring Okta SAML 2.0 Single Sign-on (SSO)

This page applies to:

Note: For details about SAML 2.0, see the SAML 2.0 Single Sign-on overview.

Before you start

Ensure you have Administrator access to the Okta admin interface.

Step 1. Provide this configuration’s basic details to PaperCut Hive or Pocket

To add and enable an Okta SSO configuration:

  1. Log in to the PaperCut Hive or Pocket admin console, and at the top-right of the page, click on your name.
  2. Select Settings > Authentication tab.
  3. Click Add SAML SSO provider. The Add SAML SSO provider modal is displayed.
  4. Select Custom SAML 2.0. The Add SSO configuration page is displayed.

    Add SAML SSO provider modal, showing three selectable options: Microsoft Entra ID, GoogleWorkspace, and Custom SAML 2.0
  5. In the Configuration name field, enter a name for this configuration. This name helps you know which configuration you’re editing or using, especially if your organization has multiple SSO configurations enabled simultaneously.
  6. In the Configuration button label field, enter the button label your users will see on your organization’s PaperCut Hive or Pocket login page. If your organization uses multiple SSO configurations simultaneously, ensure the button label helps users choose the correct login option.

Step 2. Add PaperCut details to Okta

  1. In a separate tab, log in to your Okta admin interface.
  2. Go to Applications > Applications.

  3. Select Create App Integration. The Create a new app integration screen is displayed.
  4. Select SAML 2.0. The Create SAML Integration screen is shown.

  5. Enter an App name for the integration with PaperCut Hive and, optionally, upload an App logo.

  6. Select both checkboxes for Do not display application icon to users and Do not display application icon in the Okta Mobile app. These options should be used as PaperCut Hive does not currently support IdP-initiated SAML authentication.
  7. Click Next. The SAML Settings screen is displayed.

  8. Return to your PaperCut Hive admin interface and copy the ACS (Assertion Consumer Service) URL. Go back to the Okta admin interface and paste this value into the Audience URI (SP Entity ID) field.
  9. In PaperCut Hive, copy the Entity ID (Issuer) URL, then in Okta, paste this value into the Single sign-on URL field.
  10. In the Okta configuration, set the Application username to Email.
  11. Click Next. The Feedback screen is displayed.
  12. Select Finish.
  1. In the Okta interface, go to the Settings screen for your new Application. Under Sign on methods > SAML 2.0, click on More details to expand the section.

  2. Copy the Sign on URL and paste it into PaperCut:
    1. Locate the Sign on URL and click Copy.
    2. Switch to the PaperCut tab, go to 3 Link Custom SAML Identity Provider back to PaperCut, and paste the URL into the SSO URL box.
  3. Copy the Okta Issuer and paste it into PaperCut:
    1. Switch to Okta and copy the Issuer URL.
    2. Switch to the PaperCut tab, go to 3 Link Custom SAML Identity Provider back to PaperCut, and paste the URL into the Entity ID box.
  4. Copy the certificate and paste it into PaperCut:

    1. Switch back to Okta, locate the Signing Certificate, and click Copy.

    2. Switch back to PaperCut and paste the details into the Certificate box.

      If you have done this correctly, a green tick and certificate validity message appears.

Step 4. Assign Authentication App to your end users in Okta.

  1. In the Okta admin interface, select your newly created PaperCut Hive SAML Application.
  2. Click the Assignments tab.
  3. Assign the SAML Application to the users and/or groups who should be able to use this sign in option via PaperCut Hive.

Step 5. Test the configuration

Test that you can log in with an email address associated with the domain(s) you’re setting up for SSO.

  1. On the PaperCut Hive or Pocket Edit SSO configuration page, in the 4 Test configuration (required) section, select Test configuration. An Okta sign-in pop-up is displayed.
  2. Log in using an account with your SSO-related credentials from the domain you configured. A test user is always a good option!
  3. Wait until a test result is displayed.
  4. Select Return to SSO configuration to return to the configuration page.

Step 6. Enable the configuration

  1. On the PaperCut Hive or Pocket Edit SSO configuration page, in the Enable configuration section:
    1. If you’re ready to immediately allow SSO access to PaperCut Hive or Pocket via this configuration, select Yes, enable now.
    2. If you’re not ready to start using this configuration, select No, enable later, and save the configuration. You can return to enable it at any time. Before enabling it, test the configuration again.
  2. Select Save. The Authentication page is displayed.
  3. Check that your SSO configuration is enabled/disabled according to your previous “Enable configuration” selection. If enabled, use a test account to check that SSO is working.

Comments