Okta Configuration

1. Note: If you do not see the "SAML System Connect" button in the Organization Settings page, please reach out to support at [e-mail]

   
   These are the configuration instructions for SAML using the Teampay App:

   1. While logged in as an Okta admin, navigate to Applications

   

   2. Select “Browse App Catalog”

   3. Search for "Teampay" and add it

   4. Set "App Label" and "Visibility" as desired

   5. Follow the set-up instructions (located in the App's "sign-on" tab)

   

   Once this is completed, you will need to do the following:

   6. Download the Metadata file from Okta

   7. Log-in to the Teampay Web App and navigate to “Organization Settings”

   8. Click “Connect” on the setting “SAML/SCIM System Connect”

   9. Upload the metadata file directly into Teampay

   10. Choose the provider, and enter password for admin user (we recommend setting up a utility user that can be shared within your organization)

2. 11. Click Submit

   12. Copy the IntegrationID SAML or RelayStateID for SCIM and download the Encryption Certificate

   13. Navigate back to Okta and update the App's IntegrationID/RelayStateID and Encryption Certificate

   * If users want to login to Teampay, for the first time, using Okta, they must first login through Okta.

   Configuring Okta SCIM

   Features

   • Create Users
   • Update User Attributes
   • Deactivate Users

    

3. Requirements

   • SAML should be configured in OKTA
   1. Make sure under the “Sign On” tab, in “Application username format”, the option “Email” is selected.

   

4.  

5. 3. Also, make sure that, in the “General” Tab, the environment “Production” is selected. If you are testing against a Demo account tho, switch it to “Demo”.

   

   4. Go to the “Provisioning” tab and click on “Configure API Integration”

   

   5. Enter the Username and Password used to setup SCIM in Teampay

   6. After testing the credentials, you should get a successful message if everything works

   a. Otherwise, contact Teampay Support team at [e-mail]

   

   7. In the “Provisioning” tab under the “To App” section, enable the features you want and configure the mappings needed

   8. All done! Now when users are created or updated in OKTA they will be provisioned and updated in Teampay.

   Troubleshooting and Tips

   Notes about attributes:

   • Given name and Family name are required attributes
   • Email synced should have the one for ‘work’ type
   • Cost center will map to Teampay’s Class if the value is equal to the ID or the DisplayName of the instance in the ERP
   • Division will map to Teampay’s Location if the value is equal to the ID or the DisplayName of the instance in the ERP
   • Department will map to Teampay’s Department if the value is equal to the ID or the DisplayName of the instance in the ERP
   • Setting up Okta’s Manager will create an Approval Group in Teampay for that Manager and set up the User in it. One of the two fields is required for this:
   • • • • Manager value to match Teampay’s User Email
         • Manager display name to match Teampay’s User Display Name