Okta SSO Configuration Guide for Inkfree

This guide shows Okta administrators how to set up Okta SSO for Inkfree using the Inkfree app in the Okta Integration Network (OIN). You add the app from the Okta catalog, enter one value from Inkfree, and Okta fills in every sign-in URL for you. The app supports both OpenID Connect (OIDC) and SAML 2.0. Okta recommends OIDC, and this guide covers both.

If you use a different identity provider, or want to build a custom Okta app instead of using the catalog app, follow the general SSO configuration guide.

Read This Before You Enable SSO

Setting up SSO doesn't change how anyone signs in until you choose to enforce it. When you turn on Enforce SSO in Inkfree, everyone with an email address on your connector's domains must sign in through Okta, and password sign-in is blocked for them.

• Inkfree keeps one password-fallback user (a break-glass account) who can still sign in with a password if Okta is unavailable. Protect that account with two-factor authentication.
• There's no separate backup sign-in URL. If Okta is unavailable, the password-fallback user can sign in with a password and pause the connector in Settings → Enterprise SSO, or you can contact the support team to disable SSO for your account.
• Test sign-in fully, as described in Step 6, before you enforce SSO.

Supported Features

The Okta Inkfree integration supports:

• SP-initiated SSO: users start at the Inkfree sign-in page and are sent to Okta to authenticate.
• IdP-initiated SSO: users click the Inkfree tile on their Okta End-User Dashboard.
• Just-In-Time (JIT) provisioning: Inkfree creates an account the first time an assigned user signs in, when Automatically onboard new SSO users is turned on.
• Sign out of Okta when signing out of Inkfree (OIDC only): when a user who signed in with OIDC signs out of Inkfree, Inkfree also ends their Okta session, then returns them to the Inkfree sign-in page. This uses the post-logout redirect URI the catalog app registers in Okta.

Both OIDC and SAML 2.0 support SP-initiated SSO, IdP-initiated SSO, and JIT provisioning. Only one connector can be live on an Inkfree account at a time, so pick one protocol.

Current limitations:

• SCIM provisioning isn't supported. Unassigning or deactivating a user in Okta stops them from signing in through SSO, but it doesn't deactivate their Inkfree account. Deactivate them in Settings → Teams as well.
• Okta group membership isn't mapped to Inkfree roles. New users get the default role set on the connector, and you can change it in Inkfree afterward.
• Sign-out from Okta is supported for OIDC only. With SAML 2.0, signing out of Inkfree ends the Inkfree session but not the Okta session.
• Signing out of Okta, or ending a user's Okta session, doesn't sign them out of Inkfree. Universal Logout isn't supported.

Prerequisites

Before you begin, make sure you have:

• An Inkfree account on a plan that includes Enterprise SSO. If Settings → Enterprise SSO shows "Enterprise SSO isn't included in your plan," contact the support team first.
• An Inkfree administrator account. Enterprise SSO appears in Settings only for administrators.
• An Okta account with the Super Administrator or Application Administrator role, so you can add apps from the OIN catalog and assign users to them.
• The email domains your team signs in with, such as acme.com. Inkfree matches the domain of the email address a user signs in with to decide who is sent to Okta.
• User email addresses in Okta that match the addresses your team uses in Inkfree. Inkfree identifies users by email.

Configuration Steps

Keep Inkfree and the Okta Admin Console open in separate browser tabs. You'll move between them twice.

Step 1: Reserve an SSO Connector in Inkfree

1. Sign in to Inkfree as an administrator and go to Settings → Enterprise SSO.
2. Click Add Connector.
3. Under protocol, choose OIDC / OAuth 2.0 (recommended) or SAML 2.0. Make a note of your choice, because you'll pick the same one in Okta in Step 3.
4. Optionally enter a Connector name, such as acme-okta.
5. In Email Domains, type each domain that should sign in with Okta and press Enter.
6. Leave Enforce SSO turned off for now.
7. To create Inkfree accounts for new users on their first sign-in, turn on Automatically onboard new SSO users and choose a Default role for new users.
8. Click Reserve connector.
9. Copy the connector's Registration ID. It's shown in small text under the connector name on the Enterprise SSO page. It's also the last part of the ACS URL and Redirect URI that Inkfree displays.

You don't need to copy any of the URLs Inkfree shows into Okta. The Okta catalog app builds them from your Registration ID.

Step 2: Add Inkfree from the Okta Integration Network

1. Sign in to the Okta Admin Console.
2. Go to Applications → Applications and click Browse App Catalog.
3. Search for Inkfree and select it.
4. Click Add Integration.
5. On General Settings, keep or change the Application label. This is the name users see on their Okta dashboard.
6. In Registration Id, paste the Registration ID you copied in Step 1. It must match exactly, with no spaces before or after it.
7. Click Done.

For more on adding catalog apps, see Okta's help article Add existing app integrations.

Step 3: Choose the Sign-On Method in Okta

Open the Inkfree app's Sign On tab and follow the steps for the protocol you chose in Step 1.

If you chose OIDC:

1. On the Sign On tab, click Edit and select OpenID Connect.
2. Set Application username format to Email.
3. Click Save.
4. Copy the Client ID and Client secret shown on the Sign On tab. You'll paste them into Inkfree in Step 5.
5. Note your Okta org URL, such as https://acme.okta.com. This is your issuer URL.

The catalog app uses Okta's org authorization server, so the issuer is your Okta org URL on its own, not a URL that ends in /oauth2/default.

If you chose SAML 2.0:

1. On the Sign On tab, click Edit and select SAML 2.0.
2. Set Application username format to Email.
3. Click Save.
4. Under Metadata details, copy the Metadata URL. You'll paste it into Inkfree in Step 5.

Okta sends the user's email address as the SAML NameID, which is all Inkfree needs to sign a user in. The app doesn't send any other attribute statements.

Step 4: Assign Users and Groups

1. Open the Inkfree app's Assignments tab.
2. Click Assign, then choose Assign to People or Assign to Groups.
3. Click Assign next to each person or group who needs Inkfree, then click Done.

Only assigned users can sign in to Inkfree through Okta.

Step 5: Enter Your Okta Details in Inkfree and Activate SSO

Return to Inkfree and click Continue to IdP details. If you closed the dialog, open the connector's ⋮ menu on the Enterprise SSO page and select Complete setup. Then enter the details for your protocol.

OIDC:

• IdP Configuration: choose Issuer URL and paste your Okta org URL, such as https://acme.okta.com. Inkfree finds the rest of Okta's endpoints automatically.
• Client ID and Client Secret: paste the values from the Okta Sign On tab.
• Client Authentication Method: leave it as Client Secret Basic (HTTP Basic header).
• Use PKCE: leave it on.
• Scopes: keep openid, email, and profile.
• End Session Endpoint: leave it blank. Inkfree finds Okta's sign-out endpoint from the issuer URL, which is what signs users out of Okta when they sign out of Inkfree.

SAML 2.0:

• IdP Configuration: choose Metadata URL and paste the Okta metadata URL into IdP Metadata URL. Inkfree reads Okta's issuer, sign-in URL, and signing certificate from it.

Click Activate SSO. The connector status changes from Setup incomplete to Live.

Step 6: Test Okta Sign-In

Test in a private or incognito browser window so an existing session doesn't hide a problem.

• From Inkfree (SP-initiated): follow the steps in SP-Initiated SSO below as an assigned user.
• From Okta (IdP-initiated): sign in to the Okta End-User Dashboard as an assigned user and click the Inkfree tile. You should land in Inkfree signed in.
• New user (JIT): if you turned on automatic onboarding, sign in as an assigned user who doesn't have an Inkfree account yet and confirm that one is created.
• From Inkfree settings: open the connector's ⋮ menu and select Test SSO.
• Sign-out (OIDC): sign out of Inkfree. You should return to the Inkfree sign-in page, and opening the Okta End-User Dashboard should ask you to sign in to Okta again.

Step 7: Enforce SSO (Optional)

After testing, you can require Okta sign-in for everyone on your domains:

1. In Settings → Enterprise SSO, open the connector's ⋮ menu and select Edit.
2. Turn on Enforce SSO (block password login for these email domains).
3. Choose a Password-fallback user (break-glass account).
4. Click Save Changes.

SP-Initiated SSO

To sign in to Inkfree from the Inkfree sign-in page:

1. Go to https://sign.inkfree.app/.
2. Click Sign in with SSO.
3. Enter your work email address and click Continue with SSO.
4. Sign in to Okta if prompted. You're returned to Inkfree, signed in.

If SSO is enforced for your domain and you try to sign in with a password instead, Inkfree tells you that your organization requires single sign-on and switches you to SSO sign-in.

Troubleshooting

Contact Support

If you get stuck, contact the support team or email support@inkfree.app. Include your connector name, the protocol you chose, and the approximate time of a failed sign-in. Never send client secrets, private keys, or passwords.