Prerequisites
- Admin access to your RansomLeak tenant
- Okta super admin or app admin rights
- Okta email matches each user's RansomLeak email
Your tenant is reachable at https://<your-subdomain>.ransomleak.com. Replace
<your-subdomain> with your own subdomain throughout this guide.
Supported features
- SP-initiated SSO
- IdP-initiated SSO
- Just-In-Time user matching
- Single Logout (SLO)
- Force authentication
- SHA-256 signed assertions
RansomLeak requires SHA-256 signed assertions. SHA-1 is not supported.
Before you enable SAML
Once SAML is enabled for your tenant, your users authenticate through Okta. If you need to turn SAML off temporarily, contact RansomLeak support and we will disable it for your tenant.
Configuration steps
RansomLeak provisions SAML per tenant. You add the RansomLeak app in Okta, then send us your Okta IdP metadata so we can configure the Service Provider side for your tenant.
-
Add the RansomLeak app from the Okta Integration Network catalog and assign it to your test users or groups.
-
Open the RansomLeak app's Sign On tab and copy these IdP values:
- Identity Provider SSO URL
- Identity Provider Issuer
- X.509 Signing Certificate
-
Send those three values to support@ransomleak.com and ask us to enable SAML SSO for your tenant. We configure the SP side and confirm when it is live. The SP endpoints for your tenant are:
ACS URLhttps://<subdomain>.ransomleak.com/api/auth/saml/callbackEntity IDhttps://<subdomain>.ransomleak.comMetadatahttps://<subdomain>.ransomleak.com/api/auth/saml/metadata -
In Okta, set the Application username format to Email.
Attribute mapping
The SAML NameID must be the user's email address
(emailAddress format). RansomLeak reads the following attributes from the
assertion:
| Name | Value |
|---|---|
email | user.email |
firstName | user.firstName |
lastName | user.lastName |
Role mapping (optional). RansomLeak can map a SAML attribute to a tenant role. To drive roles from Okta, include a role or group attribute and tell us which attribute to map.
SP-initiated sign-in
-
Go to your RansomLeak sign-in page:
https://<subdomain>.ransomleak.com/app/login Choose Sign in with SSO. You are redirected to Okta.
-
After you authenticate with Okta, you land back on the RansomLeak dashboard.
Troubleshooting
| Symptom | Fix |
|---|---|
| Redirect loop or "invalid audience" | Confirm the Entity ID / Audience value matches what Okta sends. |
| "User not found" | The Okta email must match the user's RansomLeak account email. |
| Signature errors | Confirm Okta is signing with SHA-256, not SHA-1. |
Need a hand?
Email support@ransomleak.com and we will help you connect Okta to your tenant.