Prerequisites
Tulip SAML integration is available for enterprise customers (see info about plans here: https://www.salto.io/pricing)
Contact support@salto.io in order to initialize the process.
Supported features
IdP-initiated SSO
SP-initiated SSO
JIT provisioning
Configuration steps
In your Okta Admin Console, browse the app catalog, search for Tulip application and add it.
For
connection_nameyou should either use the one you got from Tulip, or you can use your domain name with hyphens instead of dots, e.g.:
acme.com → acme-com
acme.co.uk → acme-co-ukAfter creating the application, select the Sign On tab, then download the Signing Certificate and copy the Sign on URL.
Contact the Tulip support team (support@salto.io) and ask to enable SAML 2.0 for your account, providing:
Signing Certificate you downloaded
Sign On URL you copied
The
connection_nameyou used (either provided by Tulip, or chosen as noted above)If you also have a Sign Out URL
Tulip support team processes your request and provide you an Encryption Certificate (PEM) that will be used to set up SAML login on your side
In your Okta Admin Console, select the Sign On tab for the Tulip app, then click "Edit" and fill in the form with the details provided by Tulip support team.
Your SAML configuration for Tulip is complete. You can start assigning users and groups to the application.
For IDP-initiated SSO, after clicking Tulip app in Okta, you will be redirected to https://app.salto.io/
For SP-initiated SSO, navigate to https://app.salto.io/login, and enter the your email address:
Troubleshooting
If you encounter any issue during the process, or a generic access denied message after authenticating through Okta, consult with Tulip support team (support@salto.io).
Please note, the Org Admin user in Tulip must invite other users to the org, otherwise when new users log in via SSO they will not be able to access the Tulip application.
See this article about inviting members for more information: