Okta SAML + SCIM setup

~10 minutes for SAML sign-in, plus another ~5 minutes if you want SCIM 2.0 automated user provisioning. Requires Okta admin access and Mnueron Business or Enterprise plan.

Step 1.Create the SAML application in Okta

In your Okta Admin Console, navigate to Applications → Applications → Create App Integration.
Pick SAML 2.0, click Next.
App name: Mnueron. App logo: optional but recommended. Click Next.

Step 2.Fill SAML settings

On step 2 of Okta's wizard, fill these fields. Replace your-org with your Mnueron org slug.

Okta field	Value
Single sign-on URL	https://www.mnueron.com/api/auth/sso/your-org/acs
Use this for Recipient URL and Destination URL	✓ (checked)
Audience URI (SP Entity ID)	https://www.mnueron.com/sso/your-org
Default RelayState	(leave blank)
Name ID format	EmailAddress
Application username	Email
Update application username on	Create and update

Step 3.Add attribute statements

Scroll down to Attribute Statements on the same page and add two:

Name (Okta)	Name format	Value
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress	URI Reference	user.email
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	URI Reference	user.displayName

Prefer short claim names like email / name? Change the Attribute mapping fields on the Mnueron connection card to match.

Step 4.Extract Okta metadata and paste into Mnueron

Click Next, then Finish.
On the new app's Sign On tab, find SAML Setup and click View SAML setup instructions.
In a separate tab, go to /dashboard/settings/sso in Mnueron and click Add connection.
Copy three values from Okta into the Mnueron form:
- Identity Provider Single Sign-On URL → IdP SSO URL
- Identity Provider Issuer → IdP entity ID
- X.509 Certificate → IdP x509 signing certificate (PEM)
Click Create draft. Don't activate yet — we still need to assign users in Okta.

Step 5.Assign users in Okta

Back in Okta, on the Mnueron app's Assignments tab, click Assign → Assign to People (or Assign to Groups) and add the people who should be able to sign in via SSO.

Step 6.Activate the Mnueron connection

Back on /dashboard/settings/sso, click Activate on the connection card. Users in the assigned Okta groups can now sign in by visiting:

https://www.mnueron.com/api/auth/sso/your-org/login

Drop that link into your wiki, intranet, or as a chiclet on the Okta End User Dashboard for one-click access.

Optional: SCIM 2.0 automated provisioning

SCIM lets Okta push user lifecycle changes (create, update, deactivate) automatically — so when you fire someone in your HR system and Okta deprovisions them, Mnueron deactivates the same minute. Recommended for any team larger than ~10 people.

In Mnueron at /dashboard/settings/sso, click Mint token. Copy the raw scim_… value immediately— it's shown only once.
In Okta, on the Mnueron app's Provisioning tab, click Configure API Integration.
Check Enable API integration.
Base URL: https://www.mnueron.com/scim/v2
API Token: paste the scim_… value from step 1.
Click Test API Credentials — expect a green checkmark.
Save, then on the To App sub-tab, enable:
- Create Users
- Update User Attributes
- Deactivate Users

Troubleshooting

/login?sso_error=assertion_invalid

Likely: IdP cert mismatch or expired

Fix: Re-export the cert from Okta (Sign On → SAML Setup → View SAML setup instructions), paste fresh PEM into the Mnueron connection's IdP x509 field.

/login?sso_error=state_mismatch

Likely: Browser cookies blocked or login took longer than 5 min

Fix: Ask the user to retry. Check for browser extensions blocking cookies. Check for clock drift on the user's machine.

/login?sso_error=saml_no_email

Likely: Attribute mapping doesn't match what Okta sends

Fix: Either update the attr_email field on the Mnueron connection, or fix the Okta claim name to the default SAML 2.0 URI.

SCIM '401 Bearer token missing or invalid'

Likely: Token wrong, revoked, or expired

Fix: Mint a fresh token in Mnueron, paste into Okta's Provisioning settings.

Every login attempt is logged to audit_log (action sso.login), every SCIM mutation to scim_audit. Available in the org admin audit view.

Setting up Entra ID (Azure AD) instead? See the Microsoft Entra ID guide. Need deeper SCIM details? See the SCIM 2.0 reference.