I. Intro

Who can perform these steps: Primary administrators.

This feature is suitable for enterprises with SAML 2.0 protocol IdP. It allows team members to log in to Feishu with an existing internal company account without registering a new Feishu account. This article uses Okta IdP as an example to demonstrate how to set up SAML 2.0 SSO login.

Please note that to successfully set up Feishu SSO login, the email address in Feishu Contacts needs to match the email address in Okta. If they do not already, please make sure that the two email addresses match.

II. Steps

You must configure the relevant information in Okta before you configure the SSO login in the Feishu Admin Console.

Set up Okta

Go to Okta and click Admin in the upper-right corner.

Log in and go to Applications > Applications.

In the upper-left corner, click Add Application.

In the upper-right corner, click Create New App.

In the pop-up, select Web and SAML 2.0, and click Create.

In General Settings, insert a name under App name. You can choose to use Feishu. Once you've named the app, click Next.

On the next page, enter the following links in the corresponding text boxes.

Single sign on URL: https://www.feishu.cn/suite/passport/authentication/idp/saml/call_back

Audience URI (SP Entity ID): https://www.feishu.cn

Scroll down and click Add Another under Attribute Statements (Optional). Make sure to add user.email as shown in the image below.

Scroll down and click Next.

On the next page, select the options as shown in the image below, and click Finish when you're done.

Go to Applications > Assignments and click Assign in the upper-left corner to add the members who need to use this application.

In the Sign On page, click View Setup Instructions.

Note down the following 3 parameters that will be used in the Feishu Admin Console.

Note: Don't include the "BEGIN CERTIFICATE" and "END CERTIFICATE" part of the third parameter.

Set up a custom company domain name

Once Okta is set up, you can log in to the Feishu Admin Console to set a domain name for members to login with by clicking Settings > Organization Info > Edit.

Set up SSO account login

Go to Settings > SSO account login. Copy and paste the 3 parameters you obtained from Okta into the corresponding boxes according to the images shown below (How to obtain the parameters). Click Save configuration > Enable login with Okta account.

You've completed SSO login setup. Try logging in to Feishu now using SSO login.

Log in with SSO

All organization members can use SSO login on both desktop and mobile. Download the latest version of Feishu, click or tap Sign in with SSO, and enter the organization's domain name. Then log in to Okta using the email and password used for Okta.

III. Related

Log in to Feishu with SSO (single sign-on)