Objective
This guide explains how to configure SAML 2.0 Single Sign-On (SSO) between Okta and Comeen Play.
This setup allows you to:
Enable secure SSO via Okta
Restrict access based on SAML attributes
Prerequisites
Before starting:
Admin access to Okta
Admin access to Comeen Play
Access to: Settings → Authentication → SAML SSO
Step 1 - Enable SAML
Log in to your Comeen account
Go to Settings
Open the Authentication tab
Enable SAML SSO
Click Configure SAML
Scroll to service provider information section:
Keep this page open and proceed to the next step in a new tab.
Step 2 - Create Comeen Play app in Okta
Log in to your Okta account
Select the application tab
Click on "Create App Integration"
Select SAML 2.0
Add Name, Logo and click on next
In Comeen Play, copy the SP ACS URL and paste it into the Single Sign-On URL field in Okta.
Do the same with the SP Entity ID, which you need to paste into the Audience URL field in Okta.
For the Name ID format, select EmailAddress.
For the Application username, choose whichever value you prefer to use.
Click on Next and Finish
Click on Sign On
Go to Attribute statements
Map the correspondence between the names of attributes in Comeen and Okta and save.
Click on View SAML setup instructions
In Okta, copy the Identity Provider Single Sign-On URL and paste it into the IdP SSO URL field in Comeen Play.
Do the same with the Identity Provider Issuer, which you need to paste into the IdP Entity ID field in Comeen Play.And the X.509 Certificate in the IdP Certificate:
Save Configuration
Step 3 - Automatic Role & Group Synchronization
When enabled:
Users are automatically assigned roles based on SAML attributes
Users are added to groups based on SAML attributes
Mappings must be configured in Roles and User Groups settings
Open SAML configuration
Go to User Attribute Synchronization and Enable automatic role and group synchronization.
Group Mapping
Go to User Group page
Edit the group you want to map
Click on Add Mapping
Enter an attribute name that you will use in Okta
Enter the value that must be entered about the user in order for them to be associated with the group.
If the SAML attribute city containsBordeaux, the user will automatically be added to the Bordeaux group in Comeen.⚠ Attribute matching is case-sensitive.
In Okta, got to the Comeen App and click on Sign On
Go to Attribute statements
Add attribute and Save
Step 4 - Conditional Access (Optional)
In the Conditional Access section:
Example configuration:
Access Control Attribute: appAccess Required Attribute Value: comeen-play
If configured:
→ Only users with appAccess = comeen-play can log in.
If left empty:
→ All authenticated users can log in.
Step 5 - Enable SSO as Default Login Method
Go to:
Settings → Authentication
Under:
Enable direct redirection
Select:
SAML
This automatically redirects users to Okta without displaying the local login screen.
Step 6 - Testing the Configuration
Recommended testing steps:
Assign the Comeen Play application to a test user in Okta
Open a private/incognito browser window
Navigate to your Comeen Play URL
Verify:
Redirection to Okta
Successful login
Automatic user creation
Proper group/role assignment