Okta acts as the SAML IdP and uses SSO and MFA to authenticate the user. Okta returns an assertion to the client applications through the end user's browser.