Documentation
Okta and Microsoft Entra ID
Connecting REAP to Okta (opens in a new tab) and Microsoft Entra ID (opens in a new tab): prerequisites, permissions, setup, what is read and written, troubleshooting.
Overview
Single sign-on to the REAP console with SAML or OIDC, and role mapping from your groups.
Prerequisites
- Okta (opens in a new tab) or Microsoft Entra ID (opens in a new tab) tenant; permission to create an enterprise application
- Groups for REAP roles role set
Permissions requested
| Scope | Permission | Why |
|---|---|---|
| SSO | SAML 2.0 or OIDC application | Authentication |
| Groups | Group claims in the assertion/token | Role mapping |
Setup
- Create the application from REAP’s metadata metadata URL.
- Configure group claims; map groups to REAP roles in the console.
- Test login for each role; verify the role mapping. Separation-of-duties enforcement (approver ≠ executor): .
What REAP reads
- Assertions/tokens; group membership claims
What REAP writes
- Nothing
Troubleshooting
| Symptom | Likely cause | Check |
|---|---|---|
| Login loops | Clock skew or wrong ACS URL | Check application settings |
| Wrong role | Group claim missing | Check claim configuration |
Changelog
- September 2026 · page created (draft).
Engineering to confirm
- SAML/OIDC metadata and supported claim formats
Last reviewed: October 7, 2026 (draft) · Owner: solutions engineering · Corrections: security@reapnet.ai