Skip to content
English - United States
Contact Us
  • There are no suggestions because the search field is empty.

Configure Okta SSO and SCIM for RocketDocs

This guide connects Okta to RocketDocs with SAML 2.0 SSO. You can also configure SCIM provisioning for RocketDocs users and groups. An Okta administrator and a RocketDocs administrator can complete these steps. Contact RocketDocs Support if your settings differ from this guide.

Placeholder Format

This guide uses <tenant> for your RocketDocs tenant name.

For example, replace <tenant> in each URL with your tenant name.

Tenant URL

https://<tenant>.rocketdocs.com

ACS URL

https://<tenant>.rocketdocs.com/api/auth/AssertionConsumerService

Login URL

https://<tenant>.rocketdocs.com/app/login

SCIM Endpoint URL

https://<tenant>.rocketdocs.com/integrationapi/scim

Signing model

  1. Okta signs the SAML assertion with the Okta IdP certificate.

  2. RocketDocs uses the Okta IdP certificate to verify the assertion.

  3. RocketDocs uses SAML for sign-in.

  4. RocketDocs uses SCIM for optional user and group provisioning.

  5. This setup does not use SAML Single Logout.

 

Step 1: Prepare the values

Required access

  1. Use an Okta account that can create and assign applications.

  2. Use a RocketDocs account that can edit System Settings.

  3. Keep one RocketDocs local administrator session open during SSO setup.

Create the RocketDocs values

  1. Record your RocketDocs tenant URL.
  2. Build the ACS URL from the tenant URL.
  3. Choose a stable SSO SP Name.
  4. Use the same SSO SP Name as the Okta Audience URI.

Tenant URL

https://<tenant>.rocketdocs.com

ACS URL

https://<tenant>.rocketdocs.com/api/auth/AssertionConsumerService

SSO SP Name

Use the existing value when one exists. Otherwise, use the full tenant URL.

Okta Audience URI

Use the exact SSO SP Name.

NameID

Use the email address that matches the RocketDocs SSO User ID.

📋Note:

Keep Allow Users To Use System Login on during setup and testing. This setting helps prevent an administrator lockout.

 

Choose how RocketDocs creates users

Existing users

Keep Auto Generate SSO User off.

SCIM provisioning

Keep Auto Generate SSO User off. Complete Steps 13 through 17.

JIT provisioning

Turn on Auto Generate SSO User only when your organization approves JIT.

 

Step 2: Create the Okta app integration

  1. Sign in to the Okta Admin Console.
  2. Go to Applications > Applications.
  3. Select create app integration.
    okta 1
  4. Select SAML 2.0.
  5. Select next.

okta 2

 

Step 3: Name the application

  1. Enter RocketDocs - <company name> in App name.
  2. Upload the RocketDocs logo if required.
  3. Keep the application visible unless your policy requires a hidden tile.
  4. Select Next.

okta 3

📋Note:

The application name controls the label that administrators and assigned users see in Okta.

 

Step 4: Configure the Okta SAML settings

  1. Enter the RocketDocs ACS URL in Single sign-on URL.
  2. Select Use this for Recipient URL and Destination URL.
  3. Enter the RocketDocs SSO SP Name in Audience URI.
  4. Leave Default RelayState blank.
  5. Select EmailAddress for Name ID format.
  6. Select Email for Application username.
  7. Select Create and update for username updates.

Single sign-on URL

https://<tenant>.rocketdocs.com/api/auth/AssertionConsumerService

Audience URI

Use the exact RocketDocs SSO SP Name.

okta 4

 

Step 5: Configure Okta signing

  1. Select Show Advanced Settings.
  2. Set Response to Unsigned.
  3. Set Assertion Signature to Signed.
  4. Set Signature Algorithm to RSA-SHA256.
  5. Set Digest Algorithm to SHA256.
  6. Set Assertion Encryption to Unencrypted.
  7. Clear Enable Single Logout.
  8. Clear Signed Requests.
  9. Do not add another requestable SSO URL.
  10. Keep Assertion Inline Hookset to None.

Okta 5

Okta still signs the assertion with the Okta IdP certificate.

 

Step 6: Configure attributes and finish

For existing or SCIM-provisioned users

  1. Do not add an attribute statement.
  2. Make sure the NameID is the user's email address.
  3. Make sure the NameID matches the RocketDocs SSO User ID.

Only when RocketDocs JIT provisioning is on

Attribute name

Okta value

email

user.email

firstname

user.firstName

lastname

user.lastName

📋Note:

RocketDocs does not require a group or role claim for sign-in.

Finish the wizard

  1. Select Next.
  2. Select I am an Okta customer adding an internal app.
  3. Select This is an internal app that we have created.
  4. Select Finish.

📋Note:

Do not enable Single Logout after the wizard finishes.

 

Step 7: Assign Okta users or groups

  1. Open the new RocketDocs application.
  2. Select the Assignments tab.
  3. Select Assign.
  4. Select Assign to Groups or Assign to People.
  5. Assign one test user or an approved group.
  6. Select Done.

okta 6

📋Note:

Do not assign Everyone unless your organization approves access for all users.

Start with one test user when your change policy permits it.

 

Step 8: Get the Okta IdP values

  1. Select the Sign On tab.
  2. Find the Metadata details section.
  3. Copy the Metadata URL for your records.
  4. Select More details.
  5. Copy the Sign on URL.
  6. Copy the Issuer.
  7. Download the Signing Certificate.

okta 7

Keep these Okta values

  • Metadata URL

  • Sign on URL

  • Issuer

  • Okta IdP signing certificate

📋Note:

The downloaded certificate is the Okta IdP certificate. It is safe to provide this public certificate to RocketDocs. Do not provide an Okta private key.

 

Step 9: Open the RocketDocs SSO settings

  1. Sign in to RocketDocs as an administrator.
  2. Open Settings.
  3. Select System Settings.
  4. Find the SSO section.
  5. Select the pencil icon to edit a setting.

okta 8

📋Note:

Do not copy the example values from the screenshot. Use the Okta values from your own application.

If you cannot see System Settings, ask a RocketDocs administrator for access.

 

Step 10: Enter the RocketDocs SSO values

RocketDocs setting

Value

Turn SSO on/off

Keep off during setup. Set on after all values are saved.

Auto Generate SSO User

Set off for existing users or SCIM. Set on only for approved JIT provisioning.

Allow Users To Use System Login

Set on during setup and testing.

Auto Generate Based On This User

Leave blank unless JIT is on. For JIT, select an active template user.

Want Assertion Signed

true

Want Response Signed

false

SSO Idp Name

Paste the Okta Issuer.

SSO Idp SignAuthnRequest

false

SSO Idp SingleSignOnServiceUrl

Paste the Okta Sign on URL.

SSO Idp PartnerCertificates

Paste the complete Okta IdP certificate text.

SSO Idp Description

Optional. Enter Okta or another useful description.

SSO SP Name

Enter the exact Okta Audience URI.

SSO SP Description

Optional. Enter a useful RocketDocs description.

 

Step 11: Copy and paste the Okta certificate

  1. Find the certificate file that you downloaded from Okta.
  2. Open the file in a plain-text editor.
  3. Use Notepad, TextEdit in plain-text mode, VS Code, or a similar editor.
  4. Select the complete certificate text.
  5. Copy the text without changing it.
  6. Edit SSO Idp PartnerCertificates in RocketDocs.
  7. Paste the complete certificate text.
  8. Save the setting.

The copied text must include both boundary lines and all text between them.

-----BEGIN CERTIFICATE-----

MIIC...all certificate characters and lines...

-----END CERTIFICATE-----

📋Note:

Copy the entire string. Include BEGIN CERTIFICATE and END CERTIFICATE. Do not remove characters, spaces, or line breaks.

If the certificate file is not readable text

  1. Return to the Okta application Sign On tab.
  2. Open View SAML setup instructions.
  3. Find the X.509 certificate.
  4. Copy the complete certificate text from the page.
  5. Paste the text into SSO Idp PartnerCertificates.

After you save, RocketDocs shows Certificate present: True.


Step 12: Activate and test SSO Activate SSO

  1. Check all RocketDocs SSO values.
  2. Keep Allow Users To Use System Login on for the first test.
  3. Set Turn SSO on/off to on.
  4. Keep the current RocketDocs administrator session open.
  5. Open a private browser window.
  6. Open https://<tenant>.rocketdocs.com/app/login.
  7. Sign in with the assigned Okta test user.
  8. Confirm that the correct RocketDocs user opens.

After a successful test

Assign the approved production users or groups in Okta.

Set Allow Users To Use System Login according to your access policy.

Keep an approved recovery method for administrator access.

If the test fails

Okta denies access

Confirm that Okta assigns the user or group to the application.

Audience error

Compare the Okta Audience URI with the RocketDocs SSO SP Name.

User not found

Compare the SAML NameID with the RocketDocs SSO User ID.

Signature error

Paste the complete current Okta IdP certificate again.

 

Step 13: Generate the RocketDocs SCIM credentials

Skip Steps 13 through 17 if your organization does not use SCIM provisioning.

Check access

  1. Sign in to RocketDocs as a system administrator.
  2. Open Settings.
  3. Select System Settings.
  4. Find the SSO section.
  5. Confirm that SCIM Provisioning appears beside SSO.

📋Note:

If SCIM Provisioning does not appear, contact RocketDocs Support.

 

Generate the credentials 

📋Note:

A new token immediately invalidates the current SCIM token. Generate a token when you are ready to update Okta.

  1. Select SCIM Provisioning.
  2. Select Generate token.
  3. Copy the SCIM Endpoint URL.
  4. Copy the Bearer Token before you close the drawer.
  5. Record the displayed expiration dat

SCIM Endpoint URL

https://<tenant>.rocketdocs.com/integrationapi/scim

Bearer Token

Use the token that RocketDocs shows after generation.

📋Note:

Store the bearer token in your approved secret store. RocketDocs does not show the token again after you close the drawer.

 

Step 14: Configure the Okta SCIM connection Enable SCIM

  1. Open the RocketDocs application in the Okta Admin Console.
  2. Select the General tab.
  3. Find App Settings.
  4. Select Edit.
  5. Select SCIM in the Provisioning field.
  6. Select Save.

📋Note:

If SCIM does not appear in the Provisioning field, contact Okta Support.

 

Enter the connection values

  1. Select the Provisioning tab.
  2. Select Settings > Integration.
  3. Select Edit.

Okta setting

Value

SCIM connector base URL

Paste the RocketDocs SCIM Endpoint URL.

Unique identifier field for users

userName

Supported provisioning actions

Select Push New Users and Push Profile Updates.

Push Groups

Select only when Okta will manage RocketDocs groups.

Authentication Mode

HTTP Header

Authorization

Paste the RocketDocs Bearer Token.
  1. Select Test Connector Configuration.
  2. Confirm that the connection test succeeds.
  3. Select Save.

 

Step 15: Configure SCIM provisioning

Enable user provisioning

  1. Select Provisioning > Settings > To App.
  2. Select Edit.
  3. Enable Create Users.
  4. Enable Update User Attributes.
  5. Enable Deactivate Users.
  6. Select Save.

Check the user mappings

Use the same email address for the SAML NameID and the SCIM userName.

Okta value

SCIM attribute

RocketDocs value

user.email

userName

SSO User ID

user.firstName

name.givenName

First name

user.lastName

name.familyName

Last name

user.email

emails (primary value)

Email
  1. Find the attribute mappings under To App.
  2. Compare the mappings with the table.
  3. Edit each mapping that differs.

Optional: Configure group push

Use group push only when Okta will manage the pushed RocketDocs groups.

📋Note:

Do not use the same Okta group for application assignment and group push.

  1. Select the Push Groups tab.
  2. Select Push Groups.
  3. Find an approved test group by name or rule.
  4. Push the approved test group.

📋Note:

If Okta deletes a pushed group, RocketDocs deletes that group and its managed memberships.

 

Step 16: Test SCIM provisioning

Provision one test user 

📋Note:

A new SCIM user has the user role and no license, privileges, or group memberships by default. Assign a RocketDocs license and any required groups or privileges before sign-in.

  1. Open the RocketDocs application in Okta.
  2. Select the Assignments tab.
  3. Assign one approved test user who is not assigned to the application.
  4. Confirm that Okta reports a successful assignment.
  5. Open RocketDocs User Management.
  6. Find the test user.
  7. Confirm the first name, last name, email, and SSO User ID.
  8. Assign a RocketDocs license and any required groups or privileges.
  9. Sign in to RocketDocs as the test user through Okta.

Test an update

  1. Change an approved profile value for the test user in Okta.
  2. Wait for Okta to send the update.
  3. Confirm the new value in RocketDocs.
  4. Restore the approved profile value in Okta.

Test deactivation when required

  1. Unassign the RocketDocs application from the approved test user.
  2. Open RocketDocs User Management.
  3. Confirm that RocketDocs deactivates the test user.
  4. Confirm that the user cannot sign in to RocketDocs.
  5. Reassign the application if the test user still needs access.

After a successful test

Assign the approved production users in Okta.

Push approved groups only when Okta will manage those groups.

Keep Auto Generate SSO User off for SCIM-provisioned users.

 

Step 17: Maintain and troubleshoot SCIM

Replace a SCIM token

Replace the SCIM token before its displayed expiration date.

  1. Plan a short provisioning interruption.
  2. Open System Settings > SSO > SCIM Provisioning.
  3. If an active token exists, select Regenerate token.
  4. If no active token exists, select Generate token.
  5. Copy the new bearer token.
  6. Replace the Okta Authorization value immediately.
  7. Run Test Connector Configuration again.

Select Revoke token when your organization stops SCIM provisioning.

If SCIM fails

Connection test fails

Check the SCIM Endpoint URL and the current bearer token.

Okta reports unauthorized

Replace a lost, expired, or revoked token.

User already exists

Match the Okta email and userName to the RocketDocs SSO User ID.

User cannot sign in

Check the SAML NameID, Okta assignment, and RocketDocs SSO User ID.

User has no access

Assign a RocketDocs license and any required groups or privileges.

 

Get support

Email support@rocketdocs.com if you need help.

Include the tenant URL, Okta Issuer, error message, and test time.

Do not send a bearer token, private key, or user password.

References: Okta SAML app integration guide, Okta SAML field reference, Okta SCIM provisioning guide, Okta SCIM 2.0 reference, and Okta app assignments and Group Push. Okta interface labels can change.