# Assign Talon.One roles in Okta

> Okta: Assign and remove Talon.One roles for SSO users.

> For the complete documentation index, see [llms.txt](https://docs.talon.one/llms.txt).

This tutorial describes how to assign [roles](/docs/product/account/account-settings/manage-roles.md) to and remove them from Talon.One users with [single sign-on (SSO)](/docs/product/account/account-settings/set-up-sso.md) using Okta.

This allows administrators to manage user access across multiple service providers using a
single identity provider, thereby simplifying the user management process and enhancing
security.

In this tutorial, the service provider is Talon.One, and the supported identity provider
is [Okta](https://www.okta.com). For more information about Okta, see the Okta
[integration documentation](https://developer.okta.com/).

:::tip
You can also assign Talon.One roles using [Microsoft Entra ID](/docs/dev/tutorials/sso-with-microsoft-entra-id.md)
as your identity provider. For assistance, contact our [support team](mailto:support@talon.one).
:::

## Prerequisites

- You have admin rights in Okta.
- You have [admin rights](/docs/product/account/account-settings/manage-roles.md#admin-role)
  in Talon.One.
- You have [set up single sign-on with Okta](/docs/dev/tutorials/sso-with-okta.md) in Talon.One.
- You have [created roles](/docs/product/account/account-settings/manage-roles.md#create-a-role)
  in Talon.One using a `talon.one-role-name` pattern for the role name. For example,
  `talon.one-contributor` or `talon.one-customer-support`.

## Create groups in Okta

In Okta, roles and permissions across applications are managed using groups. To set up
access for Talon.One, you should create a group for each corresponding Talon.One role.

To create a group:

1. In the Okta Admin Console, open **Directory** > **Groups**.
1. Click **Add group**.
1. In **Name**, enter the exact Talon.One role name for the group you are creating, for
   example, `talon.one-contributor`. This ensures that the group in Okta is mapped to the
   corresponding role in Talon.One.
1. (Optional) In **Description**, enter a description for the group.
1. Click **Save**.

:::important
To give users [admin rights](/docs/product/account/account-settings/manage-roles.md#admin-role)
only in Talon.One, in Okta, create a group named `talon.one-admin`. Any users added to this
group are automatically assigned the Admin role in Talon.One.
:::

## Create attribute statements in Okta

Creating a user attribute statement in Okta sends user details, such as group assignments, to Talon.One. This ensures that users get the correct access when they sign in.

To create a new attribute statement:

1. In the Okta Admin Console, click **Applications** in the main menu, and open the [application that connects to Talon.One](/docs/dev/tutorials/sso-with-okta.md#create-a-talonone-app-in-okta).
1. Click **General** > **SAML Settings** > **Edit**.
1. Click **Next** to access the **Configure SAML** section.
1. In the **Group Attribute Statements** section, configure the following parameters:
   - In **Name**, enter `talonOneProvisioningEnabled`.
   - In **Name format**, select `Unspecified` from the drop-down list.
   - In **Value**, enter a value or choose one from the drop-down list. This field cannot remain empty.
1. Click **Next**, then **Finish**.

## Create a group attribute statement in Okta

Creating a user attribute statement in Okta sends user details like group assignments to
Talon.One, ensuring users get the correct access when they sign in.

To create a group attribute statement:

1. In the Okta Admin Console, open the [application that connects to Talon.One](/docs/dev/tutorials/sso-with-okta.md#create-a-talonone-app-in-okta).
1. In the **General** tab, in **SAML Settings**, click **Edit**.
1. Click **Configure SAML**.
1. In **Group Attribute Statements**, configure the following parameters:
   - In **Name**, enter `talonOneRole`.
   - For **Name format**, select `Unspecified`.
   - For **Filter**, select `Starts with` and enter `talon.one`.
1. Click **Next** > **Finish**.

## Assign user roles

After setting up the [groups](#create-groups-in-okta) and [attribute statement](#create-a-group-attribute-statement-in-okta),
you can assign Talon.One roles to users by adding them to the corresponding Okta groups.

:::important
Assigning roles to a user in Okta replaces any roles they already have in Talon.One
after they sign in using SSO.
:::

### Assign roles to a user

To assign one or more Talon.One roles to a user:

1. In the Okta Admin Console, open **Directory** > **People**.
1. Select the user you want to assign the roles to.
1. In **Groups**, in the search bar, enter `talon.one` and select the [groups](#create-groups-in-okta)
   you want to add the user to. Each group should correspond to a role in Talon.One.

Any changes to the assigned roles are applied when the user signs in to Talon.One with
their Okta account.

### Assign a role to multiple users

To assign a Talon.One role to multiple users:

1. In the Okta Admin Console, open **Directory** > **Groups**.
1. Select the [group](#create-groups-in-okta) you want to add users to. Each group should
   correspond to a role in Talon.One.
1. Click **Assign people**.
1. To the right of each user you want to add to the group, click **+**.

Any changes to the assigned roles are applied when the users sign in to Talon.One with
their Okta account.

:::tip
You can also [assign a role to multiple users](https://help.okta.com/en-us/content/topics/apps/apps-manage-assignments.htm)
from the **Assignments** tab of the [Talon.One application](/docs/dev/tutorials/sso-with-okta.md#create-a-talonone-app-in-okta)
in Okta.
:::

### Remove a role from a user

To remove a Talon.One role from a user, remove the user from the corresponding Okta group.
For details, see the [Okta documentation](https://help.okta.com/en-us/content/topics/users-groups-profiles/usgp-remove-group-people.htm).

## Related pages

- [Set up single sign-on](/docs/product/account/account-settings/set-up-sso.md)
- [Set up single sign-on with Okta](/docs/dev/tutorials/sso-with-okta.md)
- [Provisioning and deprovisioning Talon.One users in Okta](/docs/dev/tutorials/provision-deprovision-users-in-okta.md)