> For the complete documentation index, see [llms.txt](https://docs.zigiwave.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.zigiwave.com/security/single-sign-on-setup-for-zigiops.md).

# Single Sign On Setup for ZigiOps

ZigiOps supports **Single Sign-On (SSO)** through the **SAML 2.0** protocol, allowing enterprise users to authenticate into the ZigiOps web console with their existing identity provider credentials instead of a local username and password.

This guide walks through configuring SAML SSO between ZigiOps and **Okta**, an identity provider (IdP) commonly used for enterprise authentication. The same principles apply when integrating other SAML 2.0 compliant identity providers.

## Why Use SSO with ZigiOps

Enabling SSO for ZigiOps allows organizations to:

* centralize user authentication through an existing identity provider
* reduce password fatigue and local account management overhead
* enforce organization wide security and access policies
* maintain a single source of truth for user identity across enterprise tools

## Access

Navigate to **ZigiOps → Settings → General Settings → Single Sign-On** to configure SSO.

## Part 1: Configure SAML in Okta

Before enabling SSO in ZigiOps, you need to create and configure a SAML application in Okta.

{% stepper %}
{% step %}

### Create an application integration

Log in to your Okta UI instance, navigate to **Applications → Applications**, and select **Create App Integration**.
{% endstep %}

{% step %}

### Select the sign-in method

Choose `SAML 2.0` as the **sign-in method** and select **Next**.
{% endstep %}

{% step %}

### Name the application

Enter a suitable **application name**, for example `ZigiWave ZigiOps SSO`, and select **Next**.
{% endstep %}

{% step %}

### Configure the SAML URLs

Enter the ZigiOps URL and port number for both the **Single sign-on URL** and **Audience URI (SP Entity ID)** fields. For example: `https://zigiops.example.com:8585`.
{% endstep %}

{% step %}

### Configure assertion encryption

Scroll down and select **Show Advanced Settings**:

* Set **Assertion Encryption** to `Encrypted`.
* For **Encryption Certificate**, upload an SSL certificate issued for the ZigiOps FQDN.

  In a contained environment, you can generate this certificate with OpenSSL.

  ```bash
  openssl req -x509 -nodes -sha256 -days 3650 -newkey rsa:2048 -keyout sp-private.key -out sp-certificate.crt
  ```

{% endstep %}

{% step %}

### Preview the SAML assertion

Scroll down and select **Preview the SAML Assertion**. This option becomes available once a user is assigned to the application.
{% endstep %}

{% step %}

### Retrieve the required values

Retrieve the required values from the generated XML document. ZigiOps needs this data to connect to Okta.
{% endstep %}

{% step %}

### Finalize the application setup

Finalize the application setup.
{% endstep %}

{% step %}

### View SAML setup instructions

Open the newly created application, go to the **Sign On** tab, and select **View SAML Setup Instructions**.
{% endstep %}

{% step %}

### Copy the identity provider values

Copy the following values from this page:

* **Identity Provider Single Sign-On URL**, for example: `https://example.okta.com/app/exampleAppName/exampleIssuer/sso/saml`
* **Identity Provider Issuer**, for example: `http://www.okta.com/exampleIssuer`
  {% endstep %}

{% step %}

### Download the signing certificate

Return to the **Sign On** tab, scroll to the **SAML Signing Certificates** section, and select **Actions → Download Certificate** to download the certificate. You will upload this certificate to ZigiOps in Part 2.
{% endstep %}
{% endstepper %}

## Part 2: Configure SSO in ZigiOps

{% stepper %}
{% step %}

### Open Single Sign-On settings

Log in to ZigiOps and navigate to **General Settings → Single Sign-On**.
{% endstep %}

{% step %}

### Complete the SSO settings

Use the data retrieved from Okta to complete the following settings:

| Setting                              | Description                                                                                                                                                                                                    |
| ------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Activate**                         | Enables SSO for the ZigiOps instance.                                                                                                                                                                          |
| **Allow local ZigiOps user login**   | Enable or disable local username and password login alongside SSO, based on your organization's preference.                                                                                                    |
| **Identity Provider**                | Select `OKTA` from the drop-down menu.                                                                                                                                                                         |
| **Identity Provider URL**            | The Identity Provider Single Sign-On URL retrieved from Okta. Example: `https://example.okta.com/app/exampleAppName/exampleIssuer/sso/saml`.                                                                   |
| **Service Provider Name**            | The application name created in Okta. Example: `ZigiWave ZigiOps SSO`.                                                                                                                                         |
| **Identity Provider's API Base URL** | The base URL derived from the identity provider's single sign-on URL. For example, if the single sign-on URL is `https://example.okta.com/app/exampleAppName`, the API base URL is `https://example.okta.com`. |
| **Entity ID / Issuer**               | The entity issuer ID or identity provider issuer. Example: `http://www.okta.com/exampleIssuer`.                                                                                                                |
| **Name ID Policy**                   | The name ID policy from Okta's SAML Assertion XML.                                                                                                                                                             |
| **Certificate**                      | Upload the Okta certificate downloaded in Part 1.                                                                                                                                                              |
| **Service Provider Private Key**     | Upload the service provider private key generated when creating the SSL certificate in Part 1.                                                                                                                 |
| {% endstep %}                        |                                                                                                                                                                                                                |
| {% endstepper %}                     |                                                                                                                                                                                                                |

## Frequently Asked Questions

<details>

<summary>Which identity providers does ZigiOps support for SSO?</summary>

ZigiOps supports any SAML 2.0 compliant identity provider. This guide uses Okta as the example, but the same configuration principles apply to other SAML 2.0 providers.

</details>

<details>

<summary>Can users still log in with a local ZigiOps account after SSO is enabled?</summary>

Yes, if the **Allow local ZigiOps user login** setting is enabled, local authentication remains available alongside SSO.

</details>

<details>

<summary>What do I need from the identity provider before configuring ZigiOps?</summary>

You need the Identity Provider Single Sign-On URL, the Identity Provider Issuer, and the signing certificate downloaded from the identity provider.

</details>

## Related Pages

* Encryption
* Hardening Web App
* General Settings


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.zigiwave.com/security/single-sign-on-setup-for-zigiops.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.