# SSO With Devise / Ruby on Rails

**URL:** <https://devforum.okta.com/t/sso-with-devise-ruby-on-rails/586>\
**Category:** SAML\
**Tags:** ruby\
**Created:** [October 17, 2017, 10:05am UTC](https://devforum.okta.com/t/sso-with-devise-ruby-on-rails/586 "2017-10-17T10:05:35Z")\
**Posts on this page:** 17\
**Page:** 1

<div class="post-metadata">

**Author:** ![thenapking](https://avatars.discourse-cdn.com/v4/letter/t/f14d63/32.png) [@thenapking](https://devforum.okta.com/u/thenapking)\
**Post date:** [October 17, 2017, 10:05am UTC](https://devforum.okta.com/t/sso-with-devise-ruby-on-rails/586/1 "2017-10-17T10:05:35Z")

</div>

I have an existing application which uses the Devise gem to allow people to login. I’ve installed the additional gem devise\_saml\_authenticatable and followed the setup instructions [here](https://github.com/apokalipto/devise_saml_authenticatable). When authenticating through Okta it always responds with 401 Unauthorized, even though the user’s account(s) are definitely working and authorized.

I’ve added the following to my devise.rb initializer.

```
config.saml_configure do |settings|
  url_base ||= "public url of my dev server"
  settings.issuer = url_base + "/users/saml/metadata"
  settings.assertion_consumer_service_url = url_base + "/users/saml/auth"
  settings.assertion_consumer_service_binding = "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
  settings.assertion_consumer_logout_service_url = url_base + "/users/saml/idp_sign_out"
  settings.authn_context = ""
  settings.idp_slo_target_url = ""
  settings.idp_cert_fingerprint_algorithm = 'http://www.w3.org/2000/09/xmldsig#sha256'
  settings.idp_cert_fingerprint = "finger print in HEX"
  settings.idp_entity_id = "http://www.okta.com/exkb0ibo50PdGUUv50h7" 
  settings.idp_sso_target_url = "https://caffenero.oktapreview.com/app/caffenero_hrportal_1/exkb0ibo50PdGUUv50h7/sso/saml" 
  settings.name_identifier_format = "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
end 

```

I’ve created an attribute-map.yml in the config directory with the following items:

```
"urn:mace:dir:attribute-def:uid": "user_name"
"urn:mace:dir:attribute-def:email": "email"

```

Can anyone give any pointers? (I can’t add the SAML response, because I get an error on this forum saying New users can only add two links in a post…)

---

<div class="post-metadata">

**Author:** ![arscroggin](https://avatars.discourse-cdn.com/v4/letter/a/c37758/32.png) [@arscroggin](https://devforum.okta.com/u/arscroggin)\
**Post date:** [December 12, 2017, 2:17am UTC](https://devforum.okta.com/t/sso-with-devise-ruby-on-rails/586/2 "2017-12-12T02:17:49Z")

</div>

@thenapking Any luck with getting Devise to work with okta? I also have a rails app that uses Devise and I’m not sure how easy/difficult it is to use Devise and okta together. Not sure why the don’t have any ruby examples either.

---

<div class="post-metadata">

**Author:** ![thenapking](https://avatars.discourse-cdn.com/v4/letter/t/f14d63/32.png) [@thenapking](https://devforum.okta.com/u/thenapking)\
**Post date:** [December 12, 2017, 5:32pm UTC](https://devforum.okta.com/t/sso-with-devise-ruby-on-rails/586/3 "2017-12-12T17:32:48Z")

</div>

Yes. But I had to use omniauth with devise. If you can manage to get google/facebook omniauth logins to work with devise, you can then adapt this to use omniauth\_saml. I’d completely avoid devise\_saml\_authenticatable, and also I wouldn’t bother trying to get any help out of Okta’s professional services either, the seem to have literally no knowledge of Ruby.

---

<div class="post-metadata">

**Author:** ![mraible](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/mraible/32/37_2.png) [@mraible](https://devforum.okta.com/u/mraible)\
**Post date:** [December 12, 2017, 6:05pm UTC](https://devforum.okta.com/t/sso-with-devise-ruby-on-rails/586/4 "2017-12-12T18:05:09Z")

</div>

We don’t have any Ruby examples because we haven’t seen a lot of demand from developers. At Stormpath, we had a Ruby on Rails SDK, and it was our least used integration. That being said, we can fix that here at Okta! If we were to create Ruby examples, what use cases and libraries would you like to see?

---

<div class="post-metadata">

**Author:** ![arscroggin](https://avatars.discourse-cdn.com/v4/letter/a/c37758/32.png) [@arscroggin](https://devforum.okta.com/u/arscroggin)\
**Post date:** [December 12, 2017, 7:47pm UTC](https://devforum.okta.com/t/sso-with-devise-ruby-on-rails/586/5 "2017-12-12T19:47:08Z")

</div>

Thanks @thenapking and @mraible. I would love to see example of how you would do SSO in a web application that uses Okta. To be more specific, I would like to use the Okta Single Sign On widget in my web app and then understand how I tie that to my users table in my Ruby on Rails app.

I’m a little lost at the moment, but I’ll continue to read and re-read the Okta documentation.

Thanks again.

---

<div class="post-metadata">

**Author:** ![thenapking](https://avatars.discourse-cdn.com/v4/letter/t/f14d63/32.png) [@thenapking](https://devforum.okta.com/u/thenapking)\
**Post date:** [December 12, 2017, 9:26pm UTC](https://devforum.okta.com/t/sso-with-devise-ruby-on-rails/586/6 "2017-12-12T21:26:05Z")

</div>

Unfortunately, I appear not to be able to reply to this post properly because it says “new users can only mention 2 users in a post, and cannot add more than two links”. I now have several working examples of this, and although I wouldn’t have time to post up a proper github demo app, I can certainly give a list of steps to add Okta to your app using an omniauth SAML strategy.

---

<div class="post-metadata">

**Author:** ![arscroggin](https://avatars.discourse-cdn.com/v4/letter/a/c37758/32.png) [@arscroggin](https://devforum.okta.com/u/arscroggin)\
**Post date:** [December 17, 2017, 1:32am UTC](https://devforum.okta.com/t/sso-with-devise-ruby-on-rails/586/7 "2017-12-17T01:32:38Z")

</div>

I was able to get it working following this link: [http://blog.cloud66.com/adding-sso-to-your-rails-application-with-saml/](http://blog.cloud66.com/adding-sso-to-your-rails-application-with-saml/)

It goes over the basic, but I still have a lot to figure out.

---

<div class="post-metadata">

**Author:** ![thenapking](https://avatars.discourse-cdn.com/v4/letter/t/f14d63/32.png) [@thenapking](https://devforum.okta.com/u/thenapking)\
**Post date:** [December 18, 2017, 10:40am UTC](https://devforum.okta.com/t/sso-with-devise-ruby-on-rails/586/8 "2017-12-18T10:40:51Z")

</div>

I’m aware of that blog, and went through the instructions several times with vanilla builds and existing sites and never managed to get it to work.

---

<div class="post-metadata">

**Author:** ![pboling](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/pboling/32/388_2.png) [@pboling](https://devforum.okta.com/u/pboling)\
**Post date:** [March 16, 2018, 2:33am UTC](https://devforum.okta.com/t/sso-with-devise-ruby-on-rails/586/9 "2018-03-16T02:33:19Z")

</div>

@mraible Any chance this Shopify project may be useful for integration of Okta in Ruby? Seems to be just that.

---

<div class="post-metadata">

**Author:** ![pboling](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/pboling/32/388_2.png) [@pboling](https://devforum.okta.com/u/pboling)\
**Post date:** [March 16, 2018, 2:35am UTC](https://devforum.okta.com/t/sso-with-devise-ruby-on-rails/586/10 "2018-03-16T02:35:03Z")

</div>

Sent previous message too soon via some keyboard shortcut I was unaware of…

> **[Shopify/oktakit](https://github.com/Shopify/oktakit)**
>
> Ruby toolkit for working with the Okta API. Contribute to Shopify/oktakit development by creating an account on GitHub.

---

<div class="post-metadata">

**Author:** ![mraible](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/mraible/32/37_2.png) [@mraible](https://devforum.okta.com/u/mraible)\
**Post date:** [March 16, 2018, 3:23pm UTC](https://devforum.okta.com/t/sso-with-devise-ruby-on-rails/586/11 "2018-03-16T15:23:20Z")

</div>

Thanks for the link @pboling! It looks like it could be useful for talking to our API, but I’m not sure it’ll help you with adding SSO to your RoR application.

---

<div class="post-metadata">

**Author:** ![dcweber88](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/dcweber88/32/430_2.png) [@dcweber88](https://devforum.okta.com/u/dcweber88)\
**Post date:** [April 6, 2018, 1:35pm UTC](https://devforum.okta.com/t/sso-with-devise-ruby-on-rails/586/12 "2018-04-06T13:35:21Z")

</div>

If you are still working on this let me know I have it working with Okta and RoR. Also other saml providers like OneLogin if you’re interested.

---

<div class="post-metadata">

**Author:** ![drbragg](https://avatars.discourse-cdn.com/v4/letter/d/e9c0ed/32.png) [@drbragg](https://devforum.okta.com/u/drbragg)\
**Post date:** [August 17, 2018, 2:41pm UTC](https://devforum.okta.com/t/sso-with-devise-ruby-on-rails/586/13 "2018-08-17T14:41:27Z")

</div>

I just got a request to integrate okta login into an existing app using devise. So any help you can offer would be greatly appreciated.

---

<div class="post-metadata">

**Author:** ![piasoftware](https://avatars.discourse-cdn.com/v4/letter/p/bbce88/32.png) [@piasoftware](https://devforum.okta.com/u/piasoftware)\
**Post date:** [August 21, 2018, 7:58pm UTC](https://devforum.okta.com/t/sso-with-devise-ruby-on-rails/586/14 "2018-08-21T19:58:49Z")

</div>

@dcweber88 , which gems would you recommend for a new rails project to add SSO ?

I’m reading blog posts that suggest devise\_saml\_authenticatable (and some that hate it), and others that suggest ruby-saml. ruby 2.3.5 and rail 5.0.6.

The blog posts for Devise look more complex, but i’m looking for a recommendation from someone who has tried. Thank you!

---

<div class="post-metadata">

**Author:** ![taylor01](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/taylor01/32/1041_2.png) [@taylor01](https://devforum.okta.com/u/taylor01)\
**Post date:** [April 6, 2019, 3:46pm UTC](https://devforum.okta.com/t/sso-with-devise-ruby-on-rails/586/15 "2019-04-06T15:46:00Z")

</div>

We use Okta with all of our RoR apps. If this is still a problem I can post some examples on how to make it work.

---

<div class="post-metadata">

**Author:** ![mraible](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/mraible/32/37_2.png) [@mraible](https://devforum.okta.com/u/mraible)\
**Post date:** [April 14, 2019, 7:40pm UTC](https://devforum.okta.com/t/sso-with-devise-ruby-on-rails/586/16 "2019-04-14T19:40:47Z")

</div>

We wrote a blog post that shows how to use Rails with Okta: [Simple Authentication with Rails and OmniAuth](https://developer.okta.com/blog/2018/09/18/simple-authentication-with-rails-and-omniauth).

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/oktadev/original/1X/589c4c5f80de422d01f47cee7185a7fb8227835c.png) [@system](https://devforum.okta.com/u/system)\
**Post date:** [January 17, 2024, 7:59pm UTC](https://devforum.okta.com/t/sso-with-devise-ruby-on-rails/586/17 "2024-01-17T19:59:31Z")

</div>

This topic was automatically closed 24 hours after the last reply. New replies are no longer allowed.