Okta Certified Administrator · Part II

Application Setup

31% of Part II — the largest hands-on use case.

Application Setup

Task 1: Add a SAML 2.0 App Integration

3 tasks · this deck covers task 1 of 3

The Task

"Add a SAML 2.0 app integration"

Most apps in the OIN catalog are pre-built. This task is about the case where you're building the SAML connection yourself, from scratch, using Okta's App Integration Wizard (AIW).

The Mechanism

1. Applications > Applications > Create App Integration
2. Choose "SAML 2.0" as the sign-in method
3. Enter general integration info
4. Enter SAML settings (per the AIW SAML field reference)
5. Optionally preview the generated XML assertion
6. Specify context: internal use, or OIN submission

The Gotcha — It's Not Done at Creation

Okta says it plainly: you must "configure your app integration to verify signed SAML assertions for SSO and trust Okta as the Identity Provider."

Signing certificates require manual configuration after creation — the wizard doesn't finish the trust relationship for you. The app side has to be configured to trust Okta too.

The Gotcha — Internal vs. Vendor

The wizard distinguishes internal apps from ones destined for OIN submission — third-party integrations may need the vendor's own SAML documentation beyond what Okta's wizard covers. OIN submissions require preliminary testing before formal review.

A Detail Worth Knowing — System Log Naming

A new SAML integration logs as either "Create application" (built via AIW) or "Update application" (added from OIN) — a small but real distinction if you're ever auditing how an app integration came to exist.

The Angle — What Trips People Up

Watch for these in your own sandbox run:

→ Finishing the wizard and assuming SSO works immediately — it doesn't until the app side trusts Okta and verifies signed assertions.

→ Not having the app's own SAML config docs on hand for a third-party/vendor app.

One Line To Remember

AIW walks you through choosing SAML 2.0, entering integration + SAML settings, and previewing the assertion — but the trust relationship isn't complete until the app side is configured to verify signed assertions and trust Okta as IdP, with signing certs set up post-creation. Internal vs. OIN-bound apps are handled differently, and creation logs as "Create application" vs. "Update application."

Sources: help.okta.com — Apps_App_Integration_Wizard_SAML.htm

Next: Task 2 →