Okta SSO

Prerequisites

Configure Okta SSO for Profit.co

1. Step 1

   Log in to your Okta account and navigate to the Admin panel.

   1. Open your browser and go to your Okta organization URL.
   2. Enter your Okta administrator credentials and sign in.

   

2. Step 2

   Search for and add the official Profit.co application from the Okta App Catalog.

   1. From the Okta Admin dashboard, select Applications from the left navigation panel.
   2. Click Browse App Catalog to open the Okta integration catalog.

   

   3. In the search bar, type Profit.co and locate the official application.

   

   4. Click Add Integration to add the Profit.co app to your Okta account.

   

   Note: Use the official Profit.co app from the Okta App Catalog to ensure full SAML and SCIM compatibility.

3. Step 3

   Grant SSO access to Profit.co by assigning users or groups to the app.

   1. Click the Settings icon next to the Profit.co app.
   2. Select Assign to Users (or Assign to Groups) from the menu.
   3. Search for and assign the users or groups who should have SSO access to Profit.co.

   

   4. Confirm each assignment — the status will show as Assigned once complete.

   

4. Step 4

   1. Click on the Profit.co app in your Applications list.

   

   2. Go to the Sign On tab.

   

   3. Scroll down and click the View Setup Instructions button.

   

   This opens the How to Configure SAML 2.0 for Profit.co instructions page, which contains the Issuer ID and X.509 Certificate required to complete the Profit.co side of the configuration.

5. Step 5

   From the SAML 2.0 setup instructions page, collect the two values needed to register Okta in Profit.co.

   1. Scroll down on the setup instructions page.
   2. Copy the Issuer ID — this is the IDP Entity ID that Profit.co uses to identify Okta.
   3. Locate the X.509 Certificate block and copy the certificate content.

   

   Note: Copy only the text between — and including — the lines BEGIN CERTIFICATE and END CERTIFICATE. Do not omit or truncate these header/footer lines.

6. Step 6

   Enter the Issuer ID and X.509 Certificate in Profit.co to complete the SAML SSO configuration.

   1. Log in to Profit.co and navigate to Settings from the left navigation panel.
   2. Click Integrations.
   3. Select the SAML SSO tab.
   4. Locate Okta and click the Authorize button.

   

   5. Paste the Issuer ID into the Issuer ID field.
   6. Paste the X.509 Certificate into the Certificate field.
   7. Click Authorize to complete the SSO registration.

   

7. Step 7

   1. Switch to the Okta End-User Dashboard tab in your browser.
   2. Click on My Apps — the Profit.co app should be visible.
   3. Click the Profit.co app tile. You should be taken directly into Profit.co without being prompted for a username or password.

   

   Note: If users are not redirected correctly, verify that the Issuer ID and X.509 Certificate in Profit.co exactly match the values from the Okta SAML setup instructions page.

Configure Okta User Provisioning for Profit.co

1. Requirements

   You need Admin access in Profit.co to retrieve the API Key and SCIM Key required to form the Bearer Token.

   • Navigate to Settings -> Security -> API Access in Profit.co
   • Copy your API Key and SCIM Key
   • Form the API Token using the format: API_KEY:SCIM_KEY

2. Step 1

   Ensure Okta sends the correct user identifier to Profit.co during provisioning.

   1. Open the installed Profit.co app in Okta.
   2. Go to the Sign On tab.
   3. Locate the Application username format setting.
   4. Select Email as the username format.
   5. Click Save.

   

3. Step 2

   Connect Okta to Profit.co’s SCIM endpoint using your API credentials.

   1. Go to the Provisioning tab within the Profit.co app in Okta.
   2. Click the Edit button.
   3. Enter the Domain (SCIM Base URL) for your Profit.co region:

   Region	SCIM Base URL / Domain
   US Region	https://app.profit.co/app/rest/platform/auth/scim/v2 Copy to clipboardCopy Link
   EU Region	https://eu2-app.profit.co/app/rest/platform/auth/scim/v2 Copy to clipboardCopy Link
   ME Region	https://me1-app.profit.co/app/rest/platform/auth/scim/v2 Copy to clipboardCopy Link
   SA Region	https://sa1-app.profit.co/app/rest/platform/auth/scim/v2 Copy to clipboardCopy Link

   4. Enter the API Token in the following format:

   Note: The API Key and SCIM Key are available in Profit.co under Settings -> Security -> API Access. Separate them with a colon with no spaces: API_KEY:SCIM_KEY.

   

4. Step 3

   Activate all provisioning actions and validate the SCIM connection before going live.

   1. In the Provisioning to App section, click the Edit button.

   

   2. Enable all provisioning checkboxes (Create Users, Update User Attributes, Deactivate Users).
   3. Click Test API Credentials to verify the connection between Okta and Profit.co.
   4. Once the test passes successfully, click Save to apply the configuration.

   

   Supported attributes for sync:

   Okta Attribute	Profit.co Field	Required
   Username	userName	Yes
   Given Name	firstName	Yes
   Family Name	lastName	Yes
   Primary Email	email	Yes
   Primary Email Type	emailType	No
   Department	department	No
   Job Title	title	No
   Active Status	active	Yes

5. Department Sync

   • Existing Departments: If the department already exists in Profit.co, the user will be assigned to it unless the department is disabled, and no duplicate departments will be created.
   • New Departments: If the department does not exist in Profit.co, it will be automatically created and the user will be assigned to it during provisioning.
   • Department and Sub-Department Sync: When a user is synced with both Department and Sub-Department attributes, the system first checks if the Department exists; if it does, the Sub-Department is created under it and the user is assigned to it, and if the Department does not exist, the system checks the user’s already associated Department and creates the Sub-Department under it if available, then assigns the user to that Sub-Department.
   • Only Sub-Department Sync: If a user is synced with only the Sub-Department attribute, the system checks whether the corresponding associated Department exists; if it does not exist, the user will still be created, but the Department and Sub-Department fields will not be synced.
   • Cross-Functional Department Mapping: To assign users to multiple departments, map the department field with comma-separated values. Profit.co automatically associates the user with all specified departments during SCIM provisioning.

6. Role Sync

   When any of the roles listed below are selected, the same role will be automatically reflected in Profit.co.

   SCIM Role	Profit.co Role
   manager	Profit Manager
   user	Profit User
   read Only	Profit Read Only
   department Access Only	Department Access Only

Configure Custom Role Attributes via SCIM

1. Step 1

   Create a custom attribute named role in both the Okta User Profile and the Profit.co Application Profile.

   Okta User Profile

   1. Navigate to Directory -> Profile Editor -> Okta User (default) and click + Add Attribute.
   2. Set the Display Name and Variable Name to role. (Note: The Variable Name must be role — all lowercase.)
   3. Set User Permission to Read Only and click Save.

   

   

   Profit.co Application Profile

   1. Navigate to Directory -> Profile Editor -> OKTA SCIM App and click + Add Attribute.
   2. Set the External Namespace as required for your configuration.
   3. Set User Permission to Read Only and click Save.

   

2. Step 2

   Set up the attribute mapping so the role value flows from the Okta user profile to Profit.co on every sync.

   1. Navigate to Directory -> Profile Editor -> Your Application -> Mappings.
   2. Select the Okta User to Profit.co tab.
   3. Map user.role to appuser.role and click Save Mappings.

   

   

   

3. Step 3

   Set the role value on individual users in Okta before they are provisioned to Profit.co.

   1. Navigate to Directory -> People, select the user, go to Profile, and click Edit.
   2. Locate the role field and enter the role (refer to the Role Sync table above).
   3. Click Save.

   Note: If you do not configure the values above correctly, the default role will be assigned in Profit.co.

   

4. Step 4

   After the user is assigned to the Profit.co app in Okta, confirm the role has been applied correctly in Profit.co.

   1. Navigate to Applications -> Profit.co -> Assignments in Okta and assign the user.
   2. In Profit.co, go to Settings -> User Management.
   3. Confirm the Role column reflects the value assigned in Okta.

   Note: Role names are case-sensitive. The value entered in Okta must exactly match a valid role name in Profit.co for the sync to apply correctly.

5. Group-Based Role Assignment

   Once a group is created in Okta and users are added to it, the same group name can be configured in Profit.co for role mapping.

   After this mapping is configured, whenever a user is added to the corresponding Okta group, Profit.co automatically assigns the predefined roles associated with that group.

   Note: The group name must be the same as the group name in Okta SCIM for the role mapping to work.

   Refer to the Group-Based SCIM Provisioning Documentation for instructions on configuring group-based user provisioning.

   

Troubleshooting and Support

Summary