SAML Setup Procedure

NOTE: Currently Quest supports the SAML setup only. The following procedures are also valid for integrations that do not require domain-based routing.

These steps must be performed by an Okta Administrator with permissions to create and manage application integrations.

Step 1: Create an SAML App in Okta
  1. Log in to your Okta Admin Console.
  2. Navigate to Applications | Applications | Create App Integration.
  3. Select SAML 2.0.
  4. Configure general SAML settings.

General SAML settings (in Okta's SAML app)

Field Value
Single sign-on URL https://<tenantID>.ciamlogin.com/login.srf
Audience URI (SP Entity ID) https://login.microsoftonline.com/<tenant-id>/
Name ID format EmailAddress (switch to persistent only if issues occur)
Application username Okta username

Attribute statements (Sign On | Edit | Configure SAML)

 

NOTE: Use the full Microsoft claim URIs, not the shortened version.
Claim URI Maps to
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress user.email
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname user.firstName
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname user.lastName
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name user.displayName (or String.join(" ", user.firstName, user.lastName))
Step 2: Collect Credentials
  1. Collect your OKTA federation details from: Applications | Your APP | Sign On | View SAML setup instructions.
  2. Collect following data:
    • Identity Provider Single Sign-On URL
    • Identity Provider Issuer
    • X.509 signing certificate. Download this from the "View SAML setup instructions" page, or from Sign On | Signing Certificates | Actions | Download certificate (PEM).

Before sending it to Quest: remove the BEGIN CERTIFICATE/END CERTIFICATE lines, remove all line breaks, and send it as a single Base64 string through your agreed secure channel (for example, encrypted email).

  • Metadata URL — built from your Okta app's external key ID: https://<okta-domain>/app/<external-key-id>/sso/saml/metadata. Quest uses this URL to renew the connection automatically whenever Okta rotates its signing certificate.

For more details, navigate to Applications | Sign On, and click View SAML setup instructions when you log in through your Okta admin account.

Step 3: Send to Quest

Send the credentials from Step 4 through one of these secure channels:

  • Encrypted email
  • Microsoft Teams private message

Wait for Quest to confirm that the federated Okta IdP setup is complete before users can sign in to QTDMP.

NOTE:

  • Do not send Client Secret through regular email or Slack.
  • BYOI currently supports Okta accounts federated with your organization's own custom domain only — Okta configurations exposing general consumer email domains (for example, Gmail) are not supported.

Troubleshooting common issues

Issue Cause Resolution
Users cannot sign in. Users or groups are not assigned to the Okta OIDC application. In Okta, open the application Assignments tab and assign the required users or groups.
Sign-in fails after redirect Likely incorrect configuration parameters in SAML app in OKTA. Update the parameters to match the Quest-provided value, then try again.

FAQs

  • Does Quest receive or store our users' Okta passwords?

No. QTDMP only receives a verified identity token after Okta authenticates the user.

  • Can some of our users sign in with Microsoft Entra ID while others use Okta?

Yes. Both sign-in methods are supported but user may see different set of organizations.

  • Can user access QTDMP before configuration setup is completed?

No, once confirmed from Quest representative that configuration is complete then user can try signing in.