# IdP configuration (Okta) > Depth-first rabbithole dossier for IdP configuration (Okta); source-anchored research pack. Parent: [Atlas Federated Authentication](https://llms-explorer.com/tree/atlas-federated-authentication/) · 4 facets · 12 facts · page: https://llms-explorer.com/tree/idp-configuration-okta/ ## Definitions - [low] Placeholder values provided in the configuration are not intended for production use and must be replaced in a later step. Sources: https://www.mongodb.com/docs/atlas/security/federated-auth-okta.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/idp-configuration-okta-072a906ad7/rabbithole-synthesis.md#core` ## How it works - [low] The Organization Owner role should be heavily restricted and not assigned to a human because it can change organization-wide settings and delete configurations. Sources: https://www.mongodb.com/docs/atlas/architecture/current/auth/authorization.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/idp-configuration-okta-072a906ad7/rabbithole-synthesis.md#patterns` ## Problems, failure modes and limitations - [low] If the domain mapping is not created, SAML login will crash with an okta/hooks/acserror. Sources: https://www.mongodb.com/community/forums/t/mongodb-atlas-okta-integration-login-error/230897 — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/idp-configuration-okta-072a906ad7/rabbithole-synthesis.md#troubleshooting` ## Facts and statements - [medium] While a federated IdP is enabled in Atlas, the platform disables any other authentication mechanisms. Sources: https://www.mongodb.com/docs/atlas/security/federated-authentication.md, https://www.mongodb.com/docs/atlas/security/manage-federated-auth.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/idp-configuration-okta-072a906ad7/rabbithole-synthesis.md#core` - [low] Atlas routes users with email addresses using mapped domains to the associated Identity Provider (IdP). Sources: https://www.mongodb.com/docs/atlas/security/federated-authentication.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/idp-configuration-okta-072a906ad7/rabbithole-synthesis.md#core` - [low] Attribute names in the SAML configuration are case-sensitive and must be typed in camelCase as shown in the documentation. Sources: https://www.mongodb.com/docs/atlas/security/manage-federated-auth.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/idp-configuration-okta-072a906ad7/rabbithole-synthesis.md#core` - [low] Once an IdP is linked to Atlas, it appears as Inactive in the Federation Management Console until at least one domain is mapped to it. Sources: https://www.mongodb.com/docs/atlas/security/manage-federated-auth.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/idp-configuration-okta-072a906ad7/rabbithole-synthesis.md#core` - [low] Using the federation resource requires an existing identity provider (IdP) linked to the Atlas organization. Sources: https://www.mongodb.com/docs/atlas/operator/current/atlasfederatedauth-custom-resource.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/idp-configuration-okta-072a906ad7/rabbithole-synthesis.md#core` - [low] For the Okta MongoDB integration, the Request Binding must be set to HTTP POST. Sources: https://saml-doc.okta.com/SAML_Docs/How-to-Configure-SAML-2.0-for-MongoDB-Cloud.html — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/idp-configuration-okta-072a906ad7/rabbithole-synthesis.md#core` - [low] For the Okta MongoDB integration, the Response Signature Algorithm must be set to SHA-256. Sources: https://saml-doc.okta.com/SAML_Docs/How-to-Configure-SAML-2.0-for-MongoDB-Cloud.html — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/idp-configuration-okta-072a906ad7/rabbithole-synthesis.md#core` - [low] For the Okta MongoDB integration, the Application username format must be set to Email. Sources: https://saml-doc.okta.com/SAML_Docs/How-to-Configure-SAML-2.0-for-MongoDB-Cloud.html — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/idp-configuration-okta-072a906ad7/rabbithole-synthesis.md#core` - [low] The Okta MongoDB integration supports SAML-based Single Sign-On (SSO) and SCIM-based automated user provisioning to centralize account lifecycle management and govern role entitlements. Sources: https://www.okta.com/integrations/mongodb-atlas/ — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/idp-configuration-okta-072a906ad7/rabbithole-synthesis.md#core` ## Related concepts - Okta — is a part of IdP configuration (Okta) - IdP — is a part of IdP configuration (Okta) - configuration — is a part of IdP configuration (Okta)