What this guide covers

• Creating a SAML 2.0 application in Okta for LinearB
• Configuring SAML settings (ACS URL, Entity ID, NameID)
• Connecting Okta to LinearB’s SSO settings
• Testing and enforcing SSO for your users

Before you begin

• Okta Admin access
• LinearB Admin role
• Your LinearB SSO settings page open:
  Settings → Authentication / SSO

1. In Okta, go to Applications → Applications.
2. Click Create App Integration.
3. Select SAML 2.0 as the sign-in method and click Next.
4. Under General Settings:
   • App name: LinearB (or your preferred label)
   • App logo: (optional) upload the LinearB logo
5. Click Next.

Example

Use the values from your LinearB SSO settings page to configure Okta.

Required SAML settings

• Single sign on URL (ACS URL):
  Copy from Single Sign-On URL in LinearB.
• Audience URI (SP Entity ID):
  https://app.linearb.io/login
• Name ID format: EmailAddress
• Application username: Email (recommended)
• Leave Attribute Statements optional unless your security team requires additional claims.

Example configuration

Finish the SAML app wizard

1. Click Next to move to the Feedback tab.
2. Select I'm an Okta customer adding an internal app.
3. Click Finish.

1. In Okta, open your new LinearB SAML application.
2. Go to the Assignments tab.
3. Click Assign → choose People or Groups.
4. Select the users or groups who should have access to LinearB, then click Assign.
5. Click Done when finished.

Tip: Start with a small pilot group, validate SSO, then roll out to the rest of your org.

Now, copy the IdP values from Okta into LinearB.

1. In Okta, go to the Sign On tab of your LinearB app.
2. Click View SAML setup instructions.
3. In LinearB, go to Settings → Authentication / SSO.
4. Fill in the fields using the Okta SAML setup page:
   • Identity Provider Issuer → copy from Okta and paste into LinearB.
   • Identity Provider SSO URL → copy from Okta and paste into LinearB.
   • X.509 Certificate → copy the full certificate string from Okta and paste into LinearB.
   • Organization email domain → enter your company domain (e.g. example.com – generic domains like gmail.com are not allowed).
5. Click Save in LinearB.
6. Toggle SAML Authentication to ON.

Optional: Enforce SSO

To require all users to sign in via Okta, check the box:
“Team members will only be able to access LinearB using your SSO provider.”

Validate the configuration with two quick tests:

1. From Okta:
   • Open the Okta End-User Dashboard.
   • Click the LinearB tile.
   • Expected result: you are logged into LinearB without being asked for a password.
2. From LinearB:
   • Navigate to the LinearB login page.
   • Click the SSO button, enter your email, and follow the redirect to Okta.
   • Expected result: Okta authenticates you and returns you to LinearB logged in.

Common issues

• “Invalid Audience” or “Entity ID mismatch”
  Verify that the Audience URI in Okta is exactly https://app.linearb.io/login.
• Looping between Okta and LinearB
  Check that the Single sign on URL in Okta matches the LinearB Single Sign-On URL.
• User not found / unauthorized
  Make sure the user:
  • Is assigned to the LinearB app in Okta, and
  • Has a matching email address in LinearB.
• Certificate errors
  Ensure the X.509 certificate in LinearB matches the active certificate in Okta.

Still stuck? Contact LinearB support at linearb.zendesk.com with screenshots of your Okta SAML settings and the LinearB SSO page.

Do I need SCIM if I use SSO?
No. SSO controls authentication. SCIM (optional) is used for automatic user and group provisioning.

What happens to existing password-based users?
After SSO is enabled, users can log in either with SSO or their previous method. If you enable “Team members will only be able to access LinearB using your SSO provider,” SSO becomes mandatory.

What role do new SSO users get by default?
New users created via SSO start as Viewer. Admins can promote them to Editor or Admin from the Users & Teams settings.

Can we use multiple IdPs for the same LinearB org?
No, a single SAML configuration is supported per LinearB organization.