Articles on: Enterprise, SSO & security

Set up Okta single sign-on (SAML) for SimplyPrint

Set up Okta single sign-on (SAML) for SimplyPrint


This guide walks you through connecting Okta to SimplyPrint using SAML 2.0, so your members sign in to SimplyPrint with their Okta accounts. You'll create a SAML app in Okta, exchange a few values between Okta and SimplyPrint, and run a test before going live.


Single sign-on is included in the Enterprise plan and the School plan. Print Farm accounts that subscribed before 2026-05-15 keep SSO as well.


Okta also works over OpenID Connect (OIDC), which is a little quicker to set up. If you'd rather use that, see Set up Okta single sign-on (OIDC). Your account runs one SSO method at a time, so pick whichever your Okta admin prefers. Turning on SAML deactivates OIDC if you had it set up, but your OIDC configuration is kept in case you switch back.


New to SSO in SimplyPrint? Start with the single sign-on overview, which compares SAML and OIDC and links every setup guide.


What you need before starting

  • Admin access to your Okta organization (the Okta Admin Console).
  • An account admin in SimplyPrint with the user registration settings permission.
  • Your account on a plan that includes SSO (see the note above).


Get your SimplyPrint SAML details

SimplyPrint describes itself to Okta with a metadata file. You'll copy two values from it into Okta.


  1. Go to Settings -> Organization and open User registration & SSO.
  2. Tick SAML Single Sign-On (SSO).
  3. Click Edit SAML Configuration.


At the top of the window you'll see a link to your unique metadata file, at https://simplyprint.io/saml/[your-account-id]/metadata. From the metadata (or the modal) you need two values for Okta:


Keep this window open, you'll come back to it to paste Okta's details in.


Create a SAML app in Okta

In the Okta Admin Console:


  1. Go to Applications -> Applications, then click Create App Integration.
  2. Select SAML 2.0, then click Next.
  3. Under General Settings, give the app a name, for example "SimplyPrint", then click Next.
  4. On the Configure SAML step, fill in:
    • Single sign-on URL - paste your SimplyPrint ACS URL (the .../idpresponse value). Leave Use this for Recipient URL and Destination URL ticked.
    • Audience URI (SP Entity ID) - paste your SimplyPrint SP Entity ID (the .../metadata value).
    • Name ID format - choose Persistent (recommended), and set Application username to a stable value such as Okta username or Email.


The Name ID you send is what SimplyPrint uses to recognise each user, so choose a stable value that won't be reassigned to someone else. Because identity is anchored on this value and not on email, a member's email can change later without breaking their account.


  1. Still on Configure SAML, add these under Attribute Statements (name on the left, value on the right):
    • firstName -> user.firstName
    • lastName -> user.lastName
    • email -> user.email
  3. (Optional, for group mapping) under Group Attribute Statements, add a statement named groups, set the filter to Matches regex, and enter .* to send all of a user's groups.
  4. Click Next, choose I'm an Okta customer adding an internal app on the Feedback step, then click Finish.


Copy Okta's IdP details into SimplyPrint

Okta now has everything it needs, so hand its details back to SimplyPrint.


  1. Open your new app and go to the Sign On tab.
  2. Click View SAML setup instructions (or open the Metadata URL). Okta shows three values:
    • Identity Provider Single Sign-On URL
    • Identity Provider Issuer
    • X.509 Certificate
  4. Back in SimplyPrint's Edit SAML Configuration window, fill in:
    • Entity ID (Issuer) - paste Okta's Identity Provider Issuer.
    • SSO URL (Login URL) - paste Okta's Identity Provider Single Sign-On URL.
    • X.509 Certificate - paste Okta's certificate, including the -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- lines.
    • SSO Binding - leave as HTTP-Redirect.
  6. Click Save.


Map user attributes

SimplyPrint needs to know which Okta attributes hold each user's details. Under the attribute mappings, match the names to what you set in Okta's Attribute Statements:


SimplyPrint field

Okta attribute

Notes

First name

firstName

Required

Last name

lastName

Required

Email

email

Optional

User group

groups

Optional, enables group mapping


The field names must match exactly what Okta sends. For how groups map to SimplyPrint user groups (and to teachers and classes in schools), see the group mapping guide.


Assign users in Okta

By default no one can use the app yet. In your Okta app, open the Assignments tab and assign the people or groups who should be able to sign in to SimplyPrint.


Test and go live

  1. Save your settings in SimplyPrint.
  2. SimplyPrint's SAML configuration has a built-in Test that shows the attributes Okta returns (email addresses are masked) without logging anyone in or creating an account. Use it to confirm first name, last name, and email arrive as expected.
  3. Then log out and sign in using the SAML SSO option on your organization's login page.


If sign-in fails, double-check the Entity ID, SSO URL, and certificate, confirm your attribute names match, and make sure the user is assigned to the app in Okta. The SAML configuration also shows the last attributes received and the last error for your provider, which is the fastest way to see why a sign-in was rejected.


How new members get accounts

Once SAML is active, assigned Okta users can sign in. Existing SimplyPrint users can link their account, and new members are created automatically the first time they sign in.


For more on linking and signing in:


Updated on: 07/07/2026

Was this article helpful?

Share your feedback

Cancel

Thank you!