# Set up SAML authentication and SSO login

> Kustomer supports a variety of SAML providers that you can use for SSO login.

Source: https://help.kustomer.com/en_us/saml-authentication-and-sso-login-rJHxwIUAw

Last updated: 2026-07-09T16:40:28.111Z

Security Assertion Markup Language (SAML) is a standard for logging users into applications based on their sessions in another context. SAML SSO works by transferring the user’s identity from one place (the identity provider) to another (the service provider) through an exchange of digitally signed XML documents.

Kustomer supports various SAML providers. The following is an example of one such integration using Okta, but these steps can be adapted to any other SAML provider.

**Who can access this feature?**

**User types**

Admins or custom roles with Security access enabled can access this feature.

  

### In this article

*   [Prerequisites](#prerequisites)
*   [Configure SAML in Okta](#okta)
*   [Configure SAML in Kustomer](#kustomer)
*   [Advanced settings](#advanced)

### Prerequisites

Before following these steps in this guide, ensure that the SAML provider you are looking to hook into describes itself as an identity provider that performs SSO authentication. If the provider you are looking to integrate with is only an [identity aggregator](https://blog.cloudflare.com/cloudflare-access-for-saas/#:~:text=That%20said%2C%20Cloudflare%20Access%20is%20not%20an%20identity%20provider%20%2D%20it%E2%80%99s%20an%20identity%20aggregator.), you would need to make the configurations explained below in the application you are using for SSO authentication.

### Configure SAML in Okta

Log into your Okta account as an Administrator, and then follow the steps below to complete the Kustomer App creation.

1.  Select **Applications** in the toolbar, then select **Add Application**.
2.  Select **Create New App.**  
    ![](https://cdn.kustomerhostedcontent.com/media/570fad9d9001bc1000163b28/26ece090999625ee59659f3d210bd9ce.png)
3.  A dialog labeled _Create a New Application Integration_ will appear. In the _Platform_ drop-down menu, select **Web**, and select **SAML 2.0** as the _Sign on method._ Then, select **Create**.  
    ![](https://cdn.kustomerhostedcontent.com/media/570fad9d9001bc1000163b28/c682d6579da1547a5d4e7c59de0e3ceb.png)
4.  Enter **Kustomer** as your app name. You can download the Kustomer logo from our [Brand Assets page for the App logo field](https://www.kustomer.com/brand-media-kit/). Select **Next** to proceed.  
    ![](https://cdn.kustomerhostedcontent.com/media/570fad9d9001bc1000163b28/e8824b1b09e13369ee39772338e596f7.png)
5.  A form titled _SAML Settings_ will appear. Fill out the fields as follows, replacing `[orgname]` with the subdomain your organization uses for your Kustomer site:  
      
    *   **Single sign on URL**: `https://[orgname].api.kustomerapp.com/auth/saml/callback`
    *   **Audience URI (SP Entity ID)**: `https://[orgname].api.kustomerapp.com/auth/saml/metadata`  
        _All other fields can be left blank._  
          
        
6.  Click **Next** at the bottom, then **Finish** on the following page.
7.  You will see the Settings for your Kustomer app. In the _Sign On_ tab click **View Setup Instructions**.
8.  The page that appears contains an **Identity Provider Single Sign-On URL**, **Identity Provider Issuer**, and **X.509 Certificate**. Leave this tab open while you access the Kustomer settings in another browser window.  
    ![](https://cdn.kustomerhostedcontent.com/media/570fad9d9001bc1000163b28/7218c21798ba7b1519eda4b8f29e7430.png)

### Configure SAML in Kustomer

To finish configuring SAML, open Kustomer in another browser window so you can copy and paste the certificate details from the Okta site into Kustomer. 

1.  Sign in to Kustomer as an admin, then navigate to **Settings ![](https://cdn.kustomerhostedcontent.com/media/570fad9d9001bc1000163b28/0542d8b3f96956563639398caae569c9.png) > Security > Authentication**.
2.  Turn on the **SAML Single Sign On** setting.
3.  Copy the **Identity Provider Single Sign-On URL**, **Identity Provider Issuer**, and **X.509 Certificate** strings from the Okta settings into the corresponding fields in the Kustomer settings.  
    ![](https://cdn.kustomerhostedcontent.com/media/570fad9d9001bc1000163b28/d7ba0620689503977089f17daacad2b4.png)
    
    **Note:** The user email address in Kustomer must match the one specified in your SSO settings.
    

Once you finish the configuration, we recommend you log out of Kustomer and log back in via SAML to test that the configuration was set up correctly. Once confirmed, you can choose only to allow users to log in via SAML by going back to **Settings ![](https://cdn.kustomerhostedcontent.com/media/570fad9d9001bc1000163b28/0542d8b3f96956563639398caae569c9.png) > Security > Authentication** and turning off the **Kustomer** setting. Turning this setting off means members in your organization will only be able to sign in to Kustomer using their SAML credentials.

### Advanced settings

You can click **Show advanced settings in the SAML Single Sign On** **settings** to access additional configuration options.

*   **Force Authentication**: Disabled by default. Enabling this requires the user to re-enter their Okta/SSO login credentials each time they want to access Kustomer. Re-authentication is required even if the user still has an active Single Sign On session with Okta or the identity provider.  
      
    
*   **Sign Authentication Requests**: Disabled by default. Enabling this will require Kustomer to send additional authorization keys to confirm access with Okta, and requires you to upload the Kustomer public certificate to your identity provider.  
      
    
*   **Allow Unencrypted Assertions**: Enabled by default. This determines whether or not the SAML assertion is encrypted. If you choose to disable this setting, you will then need to upload the Kustomer public certificate to Okta or the identity provider.

### Troubleshooting access provisioning for third parties

If your organization uses SSO-only authentication, third-party partners need an approved way to sign in before they can access Kustomer.

To grant access to an external partner, use one of the following options:

**Add the partner to your organization’s SSO.**  
Provision the partner through your identity provider using an email address on an approved SSO domain.

**Allow username and password login.**  
Enable Kustomer login in your authentication settings so the partner can sign in with a standard username and password.

**Assign the appropriate permissions.**  
Add the partner as a collaborator user and limit their permissions to only the access they need.