Skip to content
GONATURELLE
Okta logoIdentity

GONATURELLE for Okta

Sign in to GONATURELLE with Okta over SAML 2.0 and provision users and groups with SCIM 2.0, so roles and offboarding follow your identity provider.

Start 14-day trialSetup steps
SAML 2.0 + SCIM 2.0
gonaturelle-role-mapping.json
{
  "saml": {
    "acs_url": "https://app.gonaturelle.si/sso/saml/acme-health/acs",
    "audience": "https://app.gonaturelle.si/sso/saml/acme-health",
    "attributes": { "email": "email", "first_name": "firstName", "last_name": "lastName", "groups": "groups" },
    "enforce": true
  },
  "scim": {
    "base_url": "https://app.gonaturelle.si/scim/v2/acme-health",
    "deprovision": "deactivate_and_revoke_keys"
  },
  "role_mapping": [
    { "okta_group": "ai-platform-admins", "role": "admin" },
    { "okta_group": "ml-engineering", "role": "engineer" },
    { "okta_group": "clinical-ai-reviewers", "role": "reviewer", "suites": ["healthcare/*"] },
    { "okta_group": "model-risk-validation", "role": "auditor" }
  ]
}

Access to evaluation results is access to sensitive material: clinical cases, adverse action rationales, privileged legal fact patterns and the thresholds that decide what ships. GONATURELLE supports SAML 2.0 single sign-on and SCIM 2.0 provisioning with Okta so that who can see and change those things is governed in the same place as the rest of your access.

SAML is configured as an app integration in the Okta Admin Console: you enter the GONATURELLE Assertion Consumer Service URL and audience URI from your tenant settings, map email, first name and last name attributes, and optionally send a groups attribute. Once SAML is enforced, password login is disabled for your domain. SCIM provisioning uses the SCIM base URL and a bearer token generated in GONATURELLE; with Create Users, Update User Attributes and Deactivate Users enabled, accounts are created on assignment and deactivated when someone is unassigned or leaves, which revokes their API keys and sessions in GONATURELLE.

Group Push maps Okta groups to GONATURELLE roles. A typical mapping gives ML engineers the engineer role, clinical or compliance reviewers the reviewer role that can change thresholds on their suites, model risk staff the read-only auditor role that can export evidence, and a small platform group the admin role. Every role change arrives through SCIM and is written to GONATURELLE's audit log, so an examiner can see who had access to which suite on a given date.

What you can test with Okta.

SAML 2.0 SSO with enforcement

SP-initiated and IdP-initiated sign-in, with enforcement that disables passwords for your verified domain and honours Okta's MFA policies.

SCIM 2.0 lifecycle

Create, update and deactivate users from Okta assignments. Deactivation revokes sessions and personal API keys immediately.

Group Push to roles

Okta groups map to GONATURELLE roles and suite-level permissions, so separation of duties between engineers and reviewers is managed in your IdP.

Audit trail of access

Every provisioning event and role change is logged with its source, supporting access reviews and the audit questions regulators ask.

Set up in 5 steps.

Most teams have a first suite running against Okta in under an hour, then add the CI gate.

Get an API key
  1. 01

    In GONATURELLE, open Settings, Security, SSO, verify your email domain and copy the ACS URL, audience URI and SCIM base URL.

  2. 02

    In the Okta Admin Console, create a SAML 2.0 app integration with those values and attribute statements for email, firstName, lastName and groups.

  3. 03

    Upload Okta's IdP metadata to GONATURELLE, test sign-in with one user, then turn on SSO enforcement.

  4. 04

    Generate a SCIM token in GONATURELLE, enable SCIM provisioning on the Okta app with HTTP header authentication, and turn on Create Users, Update User Attributes and Deactivate Users.

  5. 05

    Push the Okta groups you use and map each one to an GONATURELLE role in the role mapping screen.

Okta integration FAQ

Which plans include SSO and SCIM?

SAML SSO is included on the Scale and Enterprise plans. SCIM provisioning and fine-grained RBAC are part of Enterprise. See the pricing page for the full plan comparison.

Do you support Microsoft Entra ID as well?

Yes. The same SAML and SCIM endpoints work with Microsoft Entra ID enterprise applications, and the role mapping is configured the same way.

What happens to CI API keys when an engineer leaves?

Personal keys are revoked on SCIM deactivation. CI pipelines should use service keys owned by a team rather than a person, so offboarding never breaks a gate; service keys are listed with their owners in the audit log.

Related integrations

All integrations

Stop testing regulated agents on generic prompts.

Run your agent against 100 industry-standard clinical or financial edge cases in 5 minutes. 14-day free production trial, no card.

Start free trialBook a technical demo