From 5006c18aec1f2b82a4cebe436204c041fee344ae Mon Sep 17 00:00:00 2001
From: Juan Mrad <juansmrad@gmail.com>
Date: Mon, 9 Feb 2026 19:56:58 -0600
Subject: [PATCH] Better Copy for SSO certificate and user guide (#37)

---
 client/src/webpages/settings/SSOSettings.tsx |  3 +-
 docs/USER_GUIDE.md                           | 29 ++++++++++++++++++++
 2 files changed, 30 insertions(+), 2 deletions(-)

diff --git a/client/src/webpages/settings/SSOSettings.tsx b/client/src/webpages/settings/SSOSettings.tsx
index 28ba531..09be7bd 100644
--- a/client/src/webpages/settings/SSOSettings.tsx
+++ b/client/src/webpages/settings/SSOSettings.tsx
@@ -159,8 +159,7 @@ export default function SSOSettings() {
         <Text id="SsoCert" size="SM">
           This is the certificate used to verify the identity of your
           organization when users attempt to log in via SSO. Please ensure this
-          certificate matches the one provided by your identity provider. For
-          more information on setting up SSO, please contact Coop directly.
+          certificate matches the one provided by your identity provider.
         </Text>
       </div>
       <Textarea
diff --git a/docs/USER_GUIDE.md b/docs/USER_GUIDE.md
index d765054..7d583aa 100644
--- a/docs/USER_GUIDE.md
+++ b/docs/USER_GUIDE.md
@@ -91,7 +91,36 @@ Rules Managers can create, edit, and deploy Rules, and they can view all metrics
 
 Once you invite a new user to Coop, you can either configure an email service to send the link to that person or copy the invite link and share it directly with them.
 
+### SSO
 
+Learn how to configure SSO using Okta SAML.
+
+Coop only supports SSO through Okta SAML.
+
+**Prerequisites**
+
+To configure Okta SAML SSO, you must:
+
+* Be in Admin mode in Okta.
+* Have group names that match exactly between Okta and SAML.
+* Have admin permissions in Coop.
+* Have the ability to create a custom SAML application.
+
+**Configuration**
+
+1. Create a [custom SAML application](https://help.okta.com/oag/en-us/content/topics/access-gateway/add-app-saml-pass-thru-add-okta.htm) in Okta. Use the following settings.
+
+   | Setting | Value |
+   | :------ | :---- |
+   | Single sign-on URL | Your organization's callback URL (e.g. `https://your-coop-instance.com/login/saml/12345/callback`). You can find your callback link in Coop under **Settings → SSO**. |
+   | Audience URI (SP Entity ID) | Your Coop instance base URL (e.g. `https://your-coop-instance.com`). |
+   | `email` attribute (in **Attribute Statements**) | `email`. This field depends on your Identity Provider's attribute mappings (e.g. Google SSO may use "Primary Email"). |
+
+2. In the **Feedback** tab, check **I'm a software vendor. I'd like to integrate my app with Okta**.
+3. In your app's settings, go to the **Sign On** tab. Under **SAML Signing Certificates → SHA-2**, click **Actions → View IdP metadata**.
+4. Copy the contents of the XML file. In Coop, go to **Settings → SSO** and paste the XML into the **Identity Provider Metadata** field.
+5. On the same page, enter `email` in the **Attributes** section.
+6. In your Okta app under **Assignments**, assign users or groups to your app.
 
 ### Wellness and Safety
 
-- 
2.51.2