How to configure Okta SSO

The published Okta app lets your team log in to Fullstory with Okta. Your teammates use their Okta credentials, and you apply the same authentication policies to Fullstory as to your other enterprise apps.

Users can log in from a Fullstory login page (service provider-initiated) or from the Fullstory tile in Okta (IdP-initiated). The published app supports:

• SP-initiated SSO
• IdP-initiated SSO
• Just-in-time (JIT) provisioning

This article covers:

• Set up SSO in Fullstory
• Map users to roles via SAML attribute
• Manage your SSO connection
• Good to know

Set up SSO in Fullstory

The SSO setup in Fullstory has three steps: General Settings, Sign On Settings, and Provisioning. Click Next to move forward and Back to return.

You'll copy a Unique connection ID from the Sign On Settings step into the published Okta app. See Sign On Settings.

General Settings

1. In Fullstory, go to Settings > Account Management > SSO. Under Single sign-on (SSO) connection, click Configure next to Generic SSO (SAML 2.0).
2. Enter an SSO connection name. Fullstory may show this name to unauthenticated users during login, so choose a name they'll recognize, like "[Your Company] SSO."
   • Note: The Require SSO for all teammates toggle stays off until you save the SSO connection. This prevents lockouts. See Require SSO for all teammates.
3. Click Next.

Sign On Settings

The published Okta app uses your Unique connection ID. Add the Fullstory app from the Okta Integration Network.

The Assertion Consumer Service (ACS) URL, Entity ID (Audience URL), and Request Signing Certificate on this screen are for a custom SAML app. Use them when you create a custom SAML app for SCIM.

1. Under Configure the Fullstory App with the Identity Provider (IdP), copy the Unique connection ID.

   

2. In Okta, paste it into Unique connection ID.

   

3. Click Next and open Sign-On Options.

4. Leave Relay State empty. Copy the Metadata URL.

   

5. Open the Metadata URL in a new browser tab. The page is an XML document. Copy that XML.
   • Note: Paste the XML document into Metadata. Pasting only the Metadata URL string leaves the connection incomplete.
6. In Fullstory, under Connect to the IdP, paste the XML into the Metadata field. Click Next.

The published app sends this SAML attribute:

• email: user.email

Add fullstoryRole when you map users to roles.

Provisioning

Under Account provisioning, choose how Fullstory creates and manages users:

• None: Fullstory doesn't create user accounts automatically. Add users in Fullstory yourself, send an invite, and they log in with SSO.
• Just-in-time (JIT) provisioning: Fullstory creates an account the first time someone logs in from your SAML SSO sign-in page. You spend less time provisioning accounts, and only people Okta authenticates get access.
  • Note: New users get a Standard seat unless you map users to roles.
• SCIM provisioning: SCIM (System for Cross-domain Identity Management) lets Okta create, update, and deactivate users and groups in Fullstory automatically. The published Okta app doesn't support SCIM. Create a custom SAML app. For setup steps, group management, and role mapping with SCIM, see SCIM Automated Provisioning & De-provisioning.
  • Note: SCIM requires an SSO connection set up in the org itself. It isn't available with Umbrella SSO.

Map users to roles via SAML attribute

Role mapping assigns Fullstory roles from information in Okta, so you don't update permissions by hand in Settings. It's optional, and it's available with None and JIT provisioning. When you use role mapping, we recommend that you turn on Require SSO for all teammates. If users log in another way, Fullstory doesn't update their roles.

If Okta sends more than one role for a user, the assignment fails silently and the user's role defaults to Standard. Fullstory doesn't resolve multiple roles automatically. A user in two groups that both send fullstoryRole gets a Standard seat.

To map roles:

1. On the Provisioning step, turn on Map users to roles via SAML attribute.

2. In the Okta app, add a SAML attribute named fullstoryRole.

   

3. Go to Directory > Profile Editor.
4. Search for the Fullstory app, then click it.

5. Click Add Attribute, then enter:

   • Display name: fullstoryRole
   • Variable name: fullstoryRole
   • Attribute required: Yes. Each assignment needs a role value.

   Click Save.

   • Note: Leave Personal unchecked when you assign the Fullstory app to groups. A Personal attribute is available when you assign a user. It is not available when you assign a group.

   

6. Back to the app in the Assignments tab, assign the user or group (depending on your preference) and enter one role value.
7. Set the value to one of these roles: guest, standard, explorer, architect, or admin.
   • Note: Role mapping doesn't support the Umbrella Manager role. Assign it from the Umbrella Users page in Settings. See Choose your umbrella managers.

Here's an example of the SAML attribute:

<saml2:Attribute Name="fullstoryRole"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified">
<saml2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">
admin
</saml2:AttributeValue>
</saml2:Attribute>

Complete setup

Click Complete setup to save the connection.

Manage your SSO connection

After you save, the three steps become tabs: General Settings, Sign On Settings, and Provisioning. To edit your connection, make your changes, then click Save Changes.

Sign-in URL

The General Settings tab shows your Sign-in URL. Users open it to start login from Fullstory or from a bookmark. On the published Okta app, this URL comes from the Unique connection ID you entered in Sign On Settings.

The URL looks like https://app.fullstory.com/sso/{unique-connection-id}.

1. Open the Sign-in URL.

   

2. Enter your Okta credentials and click Sign in with Okta.

   

If your credentials are valid, you land in the Fullstory dashboard.

IdP-initiated login

Assign each user or group to the Fullstory app in Okta. Leave Relay State empty. Users then open the Fullstory tile in the Okta dashboard to sign in.

Require SSO for all teammates

New connections start in optional mode. Users can log in with a Fullstory username and password or with SSO.

To require SSO, save the connection, then turn on Require SSO for all teammates on the General Settings tab. After you turn it on, all users with an Explorer, Standard, Admin, Architect, or Umbrella Manager seat type must log in with SSO and can no longer use a username and password.

Domains for SSO login

Under Domains for SSO Login, a Fullstory admin can list their email domain. To add another email domain, invite a teammate who has an email address on that domain and grant them admin access so they can add it. To delete a domain, click Remove.

When SSO is required and someone enters an email address on a listed domain, the Fullstory login page redirects them to your SSO login page.

Free email providers, like Gmail and Outlook, are not supported.

Certificate expiration

The Sign On Settings tab shows when your certificate expires. Update it before the expiration date:

1. On Sign On Settings, click Update metadata.
2. Paste your IdP's new metadata.xml contents. In Okta, open the Metadata URL again and copy the XML document.
3. Click Save Changes.

Good to know

What happens when I remove a user from Okta?

It depends on your provisioning option:

• None or JIT: Removing a user in Okta doesn't remove them from Fullstory. Delete them in Fullstory under Settings > Account Management > Users.
• SCIM: Okta deprovisions the user in Fullstory automatically. SCIM uses a custom SAML app. To learn how Okta handles deprovisioning, see SCIM Automated Provisioning & De-provisioning.

How do I set up SSO while onboarding with a Fullstory partner?

If you are working with a Fullstory partner or other third party that needs access to your Fullstory account, set the Require SSO for all teammates toggle to off. This allows your internal team to continue using SSO while external users log in with a username and password. If you need Require SSO for all teammates to remain on, add the third-party email addresses in Okta so they can authenticate through your SSO flow.