Set up Okta for SAML 2.0 SSO

Overview

Note: This article primarily applies to Ramp Administrators.
Cardholders may find other articles in the Ramp overview section to be more applicable.

This article covers how to use Okta for Single Sign On (SSO). For System for Cross-domain Identity Management (SCIM) for your Ramp account, please refer here.

SSO will allow your employees to access Ramp through Okta seamlessly and securely. SCIM will allow you to manage your Ramp users from the Okta platform. With SCIM you can invite users, update profile attributes, and terminate users automatically via Okta. 

Jump to:

• Install the Ramp application in Okta
• SAML 2.0 for SSO
• SCIM integration
• Sept 2024 update

Install the Ramp application in Okta

Note: Starting in Sept 2024, Ramp will be rolling out a new SAML configuration flow that will provide admins with step-by-step instructions to set up SAML within the application.

In order to set up SAML authentication, you must first set up the Ramp application in Okta. 

1. In a new browser tab, log in to your Okta tenant
2. Navigate to Applications > Applications:

1. Click Browse App Catalog, search for Ramp, and click on the Ramp Application to view
2. Click Add Integration
   
3. Under General Settings:
   • Enter the Application Label; You can change the application label but we recommend using “Ramp.” This is the name of the app that your employees will see when accessing Ramp via Okta. 

Since Ramp does not support IdP-initiated logins, you should check the box: Do not display application icon to users

Supported SAML Features

The Okta/Ramp SAML integration currently supports the following features:

• • SP-initiated SSO

Set up Okta SSO on Ramp

Configuration Steps

1. In a new browser tab, log in to your Okta tenant
2. Navigate to Applications > Applications
3. Open the Ramp application in Okta
4. Switch to the Sign On tab
5. Copy the "Metadata URL"                 
6. In a new browser tab, login to Ramp
7. Navigate to Settings > Company Settings
8. From the Company Profile tab, scroll down to the Account Access section
9. Click on Enable Okta Single Sign-On
10. Paste the metadata URL (copied in Step 5) into the text field as instructed:

Note

Ensure you entered the correct value in the "Subdomain" field under the General tab. The wrong subdomain value prevents you from authenticating through SAML to Ramp.

Since only SP-initiated flow is supported, Okta recommends hiding the application icon for users.

The following SAML attributes are supported. Ensure you preserve capitalization for each of the names below; for example, in "firstName" make sure the 'N' is capitalized:

SP-initiated SSO

1. Go to: https://ramp.com/sign-in

2. Click Sign in with Okta.

3. Enter your email, then click Continue to Okta.