Hi Auth0 team,
We’re testing the Self-Service SSO setup flow (the link an admin shares with a customer’s IT admin) with Okta as the IdP over SAML. The Attribute Mapping step doesn’t match the current Okta Admin Console, which makes the setup hard to follow for a customer’s IT admin.
1. Outdated screenshot and location
The step says: “On the Authentication tab step, scroll down to the Attribute Statements section” and shows an older Okta UI (“Attribute Statements (optional)” during app creation).
In the current Okta Admin Console, attribute statements are on the app’s Sign On tab → Attribute statements, where new apps get an Add expression button. The Name / Name format / Value form from the screenshot is only available under Show legacy configuration. There is no “Authentication tab” step.
2. Role attribute from the wizard is not accepted by Okta
The wizard suggests the role attribute http://schemas.microsoft.com/ws/2008/06/identity/claims/role. When adding it as a profile attribute statement in Okta, Okta rejects it: We found some errors. Please review the form and make corrections..
Expected
- Instructions and screenshots that match the current Okta Admin Console (new “Add expression” flow, or a pointer to “Show legacy configuration”).
- A role attribute that Okta accepts, or guidance on how to send roles from Okta (Okta has no native app roles, so a custom profile attribute is usually needed).
- Ideally, explicit guidance for group attribute statements (name, filter “Matches regex .*”).
Steps to reproduce
- Generate a self-service SSO setup ticket and open the link.
- Choose Okta → SAML.
- Go to the Attribute Mapping step and compare it with the current Okta Admin Console.
Screenshots attached: the wizard step, the current Okta Sign On tab, and the Okta error for the role attribute.
Thanks!