SAML 2.0

Set up single sign-on using any SAML 2.0 identity provider (IdP) – for example Okta, Entra ID, OneLogin, or W3ID. Use this guide when your provider isn’t covered by one of the native integrations.

The setup runs in three phases: create the application in your IdP, configure Instruqt with the IdP’s details, then finish the application in your IdP with the values Instruqt generates.

Prerequisites

• A SAML 2.0 identity provider account with administrative privileges
• An Instruqt account with access to your team’s SSO settings

Phase 1 – Configure your SAML application (in your IdP)

1. Log in to your IdP’s administrative console.
2. Create a new application for Instruqt, configured for SAML 2.0. The exact process varies by provider.
3. If the setup requires configuration values you don’t have yet, use placeholders – you complete them in Phase 3.
4. Save the application to generate the IdP metadata.

Then collect these three values from your IdP:

• Entity ID – the unique identifier of the SAML application
• Signing Endpoint (SSO URL) – the URL where Instruqt sends authentication requests
• Signing Certificate – the X.509 certificate your IdP uses to sign SAML assertions

Phase 2 – Configure Instruqt

1. In the sidebar, click Settings → SSO.
2. Select the SAML option.
3. Enter the three values from Phase 1: Entity ID, Signing Endpoint (SSO URL), and Signing Certificate (Base64).
4. Click Save.

Note

The signing certificate must be Base64-encoded before entering it. The raw certificate starts with -----BEGIN CERTIFICATE-----; encode it with:

cat cert.pem | base64

After saving, Instruqt generates the service provider details you need for Phase 3:

• Assertion Consumer Service (ACS) URL – where your IdP sends the SAML response. Format:

  https://sso.play.instruqt.com/login/callback?connection={team-name}-samlp&organization_id={organization_id}

  The organization ID appears only after you save.
• Email attribute mapping (NameID format) – required for user identification:

  http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress

Phase 3 – Finalize in your IdP

1. Return to the SAML application in your IdP’s administrative console.
2. Set the Assertion Consumer Service (ACS) URL to the exact value from Phase 2.
3. Make sure the email attribute maps to http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress.

Your team members can now sign in through your team’s login URL: https://play.instruqt.com/{team-name}/login.

FAQ

Does Instruqt support de-provisioning or SCIM? Not at this time. If your use case requires de-provisioning, contact our support team and share your request.