Unified SSO authorization for Okta

👍

Welcome note

Unified login is in the process of being applied to all users throughout September 2025.

Access the pre-existing documentation here: Administration.

SSO authorization is an extension of SSO authentication. It enables you to define user privileges and control what they can access within Bloomreach products.

This guide explains how to configure SSO authorization for Okta.

📘

Note

The SSO authorization uses role_mapping to determine user permissions. For role mapping configuration details, see the Unified SSO overview guide.

Prerequisites

Before configuring SSO authorization for Okta, you must complete the SSO authentication setup in Okta. You’ll also need:

• Admin role in Bloomreach.
• Admin access to your Okta account.
• Understanding of your organization's role structure.
• Active SSO feature enabled on your account.

Configure role mapping in Okta

Add the role mapping attribute

Okta sends the role_mapping value as a SAML attribute. This value must match the mapping role names you configure in Bloomreach.

1. Access your Okta administration dashboard.
2. Go to Applications.
3. Select your Bloomreach SSO application and go to the General tab.
4. Find SAML Settings and click Edit.
5. Click Next to reach the Configure SAML section.
6. Scroll to Attribute Statements.
7. Add a new attribute:
   • Name: role_mapping.
   • Name format: Basic.
   • Value: Select your preferred value (for example, user.division).
8. Click Next and then Finish.

The role_mapping value will be included in the SAML claim. The value comes from a user profile field, user group, or fixed string value. The value must match the mapping role names you configure in Bloomreach.

Set up authorization in Bloomreach

Configure mapping roles in Bloomreach to connect identity provider values with application permissions.

Create mapping roles

1. Navigate to Administration > Users > Mapping roles.
2. Click New mapping role.
3. Enter a mapping role name that exactly matches the role_mapping value from your identity provider to the “Incoming role name” field.
4. Add an optional description for the mapping role.
5. In the Permissions section, select an application (for example, Engagement).
6. Choose at least one scope:
   • Workspace: Applies to all projects within a workspace.
   • Project: Applies to specific projects.
7. Select one or more roles for the chosen scope.
8. Click Add permission to add roles for additional scopes or applications.
9. Click Save.

📘

Important

The role mapping must include all scopes and roles that users with this mapping will need.

Enable SSO authorization

After creating and configuring the role mapping setup, activate SSO authorization in Bloomreach.

Important prerequisite

• Before enabling SSO authorization, verify that mapping roles in Bloomreach match role_mapping claim values in Okta. Incorrect configuration can prevent login access.

1. Go to Administration > Settings > Single sign-on > Preferences.
2. Scroll to the bottom of the page.
3. Enable Single sign-on authorization.
4. Click Save changes.

Users with the SSO Account Admin role can disable this option later if needed.

Next steps

• Invite your users to use the SSO login
• Manage user access and user roles