Skip to main content
SAML single sign-on lets your team sign in to Great Question with your existing Okta credentials. This guide walks through configuring the Great Question application in Okta and connecting it to your Great Question account.
SAML authentication is available on Enterprise plans only. Each Great Question account supports a single SAML provider at a time, if you need Azure AD instead, see the Azure AD SAML guide; setting one up replaces the other. Other providers, such as Google Workspace, OneLogin, and JumpCloud, use the same ACS URL, Entity ID, Name ID format, and attribute names shown in Step 1, mapped to the matching user fields in that provider.

​
Step 1: Create the application in Okta

  1. In the Okta admin console, create a new SAML 2.0 application.
  2. Configure the following URLs:
  1. Set Name ID format to EmailAddress and Application username to Email.
  2. Map these attributes:

​
Step 2: Connect Okta in Great Question

  1. In Great Question, go to Settings > Governance > Security.
  2. Under Authentication methods, enable SAML.
  3. Click Setup next to SAML configuration and enter the three values from Okta’s setup instructions:
    • Identity Provider Single Sign-On URL
    • Identity Provider Issuer
    • X.509 Certificate
If Okta gives you a Federation Metadata XML file or metadata URL instead of individual values, it contains everything you need, extract the Entity ID, SSO URL, and X.509 certificate from it and enter those three values manually above. Great Question’s setup form doesn’t accept a metadata file or URL directly.
Paste the X.509 certificate exactly as provided, including the -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- lines and all line breaks. Extra whitespace or missing header lines are the most common cause of a failed connection.

​
Signing in

Once SAML is configured, any user with access to Great Question in Okta can sign in directly from their Okta profile. A first-time sign-in with no pending invite defaults to a free Observer account. Existing Great Question users can connect their Okta login by going to greatquestion.co/sso and entering their work email.
Still need help? Contact us at support@greatquestion.co — median response time is 19 minutes during support hours.