Configure SSO with Okta

This page describes how to set up Pinecone with Okta as the single sign-on (SSO) provider. These instructions can be adapted for any provider with SAML 2.0 support.

This page assumes you have the following:

• Access to your organization's Pinecone console as an organization owner.
• Access to your organization's Okta Admin console.

First, start setting up SSO in Pinecone. In this step, you'll capture a couple values necessary for configuring Okta in Step 2.

1. In the Pinecone console, go to Settings > Access > Identity provider.
2. In the Single sign-on section, click Enable SSO.
3. In the Setup SSO dialog, copy the Entity ID and the Assertion Consumer Service (ACS) URL. You'll need these values in Step 2.
4. Click Next.

Keep this window or browser tab open. You'll come back to it in Step 4.

In Okta, follow these steps to create and configure a Pinecone app integration:

1. If you're not already on the Okta Admin console, navigate there by clicking the Admin button.

2. Navigate to Applications > Applications.

3. Click Create App Integration.

4. Select SAML 2.0.

5. Click Next.

6. Enter the General Settings:

   • App name: Pinecone
   • App logo: (optional)
   • App visibility: Set according to your organization's needs.

7. Click Next.

8. For SAML Settings, enter values you copied in Step 1:

   • Single sign-on URL: Your Assertion Consumer Service (ACS) URL
   • Audience URI (SP Entity ID): Your Entity ID
   • Name ID format: EmailAddress
   • Application username: Okta username
   • Update application username on: Create and update

9. In the Attribute Statements (SAML) section, create the following attribute:

   • Name: email
   • Value: user.email

10. Click Next.

11. Click Finish.

Next, in Okta, get the URL and certificate for the Pinecone application you just created. You'll use these in Step 4.

1. In the Okta Admin console, navigate to Applications > Pinecone > Sign On. If you're continuing from the previous step, you should already be on the right page.

2. In the SAML 2.0 section, expand More details.

3. Copy the Sign on URL.

4. Download the Signing Certificate.

In the browser tab or window you kept open in Step 1, complete the SSO setup in Pinecone:

1. In the SSO Setup window, enter the following values:

   • Login URL: The URL copied in Step 3.

   • Email domain: Your company's email domain. To target multiple domains, enter each domain separated by a comma.

   • Certificate: The contents of the certificate file you copied in Step 3.

2. Choose whether or not to Enforce SSO for all users.

   • If enabled, all members of your organization must use SSO to log in to Pinecone.
   • If disabled, members can choose to log in with SSO or with their Pinecone credentials.

3. Click Next.

4. Select a Default role for all users who log in with SSO. You can change user roles later.

Okta is now ready to be used for single sign-on. Follow the Okta docs to learn how to add users and groups.

Optionally, you can have Pinecone assign organization and project roles automatically from your identity provider on each login, instead of managing them manually. For more information, see Manage roles with Okta.