Configuring Okta SSO

This guide outlines the steps to configure Single Sign-On (SSO) with Okta for Qualified. Follow these instructions to streamline authentication for your users and enhance security.

Prerequisites

1. Access to the Okta Admin Console with super admin access.
2. Access to Qualified’s Enterprise Single Sign-On and the Admin user role.
3. Your organization’s Company ID from Qualified.
4. A basic understanding of SAML 2.0 configuration.

Steps to configure Okta SSO

Step 1: Set up in Qualified

1. Log in to your Qualified Admin account.
2. Navigate to Settings → Organization → Single Sign-On.
3. Select Okta (SAML 2.0) from the dropdown menu.
4. Copy your Company ID.

Step 2: Configure in Okta

1. Log in to the Okta Admin Console.
2. Go to Applications → Applications, and click Add Application.
3. Search for the Qualified app (not Qualified.io) and click Add Integration.
4. Keep the default application label, or customize it, and click Done.
5. Within the application, click on the Sign On tab, and then click Edit.
6. Scroll down to the Advanced Sign-on Settings section and paste in the Company ID that you copied from Qualified, and click on Save.

7. Then, scroll back up to copy the Metadata URL. 

Okta Documentation: Add existing app integrations

Step 3: Finalize SSO in Qualified

1. Return to Settings → Organization → Single Sign-On in Qualified.
2. Paste the Identity Provider metadata link from Okta into the required field.
3. Click Save and then Verify Configuration to test the connection.
4. Before enabling single sign-on, make sure to assign all existing Qualified users access to the Qualified application in Okta (including yourself) as they will no longer be able to access Qualified with their password once SSO is enabled.
   • Existing users will receive an email to bind their accounts.
5. When you’re ready, click Enable single sign-on for this org.

Multiple Qualified orgs on one identity provider

If your company has more than one Qualified org, you can connect each of them to the same Okta tenant. Each Qualified org needs its own app integration in Okta.

• First org: Follow the steps above as written, using the Qualified app from the Okta catalog.

• Each additional org: The catalog app’s Entity ID can’t be edited, so create a custom SAML 2.0 app integration for the org instead. Set its Entity ID to https://app.qualified.com/[PASTE_YOUR_COMPANY_ID_HERE], using that org’s Company ID from Settings → Organization → Single Sign-On.

Enable SCIM provisioning (optional)

SCIM provisioning in Okta automates user management tasks such as creating, updating, and deactivating users in Qualified.

Supported provisioning features

The following provisioning features are supported within Qualified provisioning of SSO users:

• Push new users: New users created in Okta are automatically created in Qualified. When a user is provisioned, their name, job title, profile (role), phone number, email, and timezone are synced.
• Push profile updates: Changes to a user's email or Qualified Role in Okta are pushed to Qualified. Other details, such as name, job title, and phone number, are set when the user is created and aren't updated afterward.
• Push user deactivation: Deactivating a user in Okta will deactivate the user in Qualified. This removes their login access but retains their information.
• Reactivate users: User accounts can be reactivated in Qualified directly from Okta.

Using custom user profiles with SCIM

In addition to the default roles, Qualified's User Profiles feature allows you to create custom permission sets. You can sync these custom profiles via SCIM by adding values to the Qualified Role attribute in Okta that match each profile's unique API Name in Qualified. The steps are in Steps to Enable SCIM Provisioning below.

Note: A profile's API Name must be all lowercase with no spaces, for example sales_manager. Qualified doesn't show an error when an API Name is formatted incorrectly, and a profile with a badly formatted API Name won't sync from Okta. Check the API Name in Qualified before you add it to Okta.

Step 1: In Qualified

1. Go to Settings → Organization → Single Sign-On.
2. Toggle on SCIM Enabled to enable SCIM provisioning.
3. Copy the SCIM OAuth Bearer Token displayed on the screen.

Step 2: In Okta

1. Log in to your Okta Admin console.
2. Go to the Applications section and open the Qualified application.
3. Click the Provisioning tab, then click Configure API integration.

4. Enable the API Integration checkbox.
   • Paste the Bearer Token from Qualified into the OAuth Bearer Token field.
   • Click Test API Credentials to verify the connection.
   • Click Save.

5. Enable provisioning actions
   • Under the Provisioning tab, click To App and then Edit.
   • Check the boxes to enable:
     • Create Users
     • Update User Attributes
     • Deactivate Users

6. Scroll down to the Attribute Mappings section and click Go to Profile Editor.

7. Find the "Qualified Role" attribute and click the pencil icon to edit it.

8. Under the "Attribute members" section, you will add values that correspond to your Qualified User Profiles. By default, "Admin" and "Rep" are included. "Rep" uses the value chat, which assigns the Chat profile in Qualified.
   • To add the default Meetings profile, click + Add Another and enter:
     • Display Name: Meetings
     • Value: meetings (case-sensitive)
   • To add a custom profile, click + Add Another and enter the profile's name and API Name. For example:
     • Display Name: Sales Manager

     • Value: sales_manager (This must exactly match the API Name in Qualified, and be all lowercase with no spaces)

9. Click Save Attribute.

Okta Documentation: Add SCIM provisioning to app integrations

Step 3: Testing and verification 

1. Add a test user in Okta and assign them to the Qualified application with one of the configured roles.
2. Verify the user is created in Qualified with the correct attributes and profile.
3. Update the test user's attributes (e.g., role or email) in Okta and confirm the changes sync correctly in Qualified.
4. Deactivate the test user in Okta and ensure their access is removed in Qualified.

Binding email process for existing users

After enabling SSO, all existing Qualified users receive an email from app@qualified.com with a unique binding link.

Users must click the link within 72 hours to bind their Qualified account to their Okta Account. If the binding link expires, an admin can resend it from Qualified by going to Settings → Organization → Users.

Adding new users

With SCIM provisioning enabled

An Okta admin assigns the user to the Qualified app with the appropriate Qualified Role attribute: Admin, Rep (the Chat profile), Meetings, or the API Name of a custom profile.

To provision a whole group instead, open the group in Okta, go to its Applications tab, click Assign Application, and assign the Qualified app. Select the Qualified Role for the group, then add users to the group.

Users added through SCIM don't receive a binding email. They sign in from the Qualified SSO page or directly from Okta.

Okta Documentation: Assign app integrations

Without SCIM provisioning

If SCIM provisioning isn’t enabled, follow these steps to add new users to Qualified:

1. Assign users in Okta: An Okta admin assigns the user to the Qualified application in Okta. See Assign app integrations.
2. Invite users in Qualified: Invite users from Settings → Organization → Users. See How to manage users in Qualified.
3. User accepts invite: Invited users will receive an email with a button to link their account and access Qualified. 

Disconnecting SSO

If you'd like to disconnect your company’s SSO, you can do so at any time.

1. Go to Settings → Organization → Single Sign-On 
2. Click Disable SSO for this team. 
3. Users will receive an email to create a new password and log in using their email addresses.