OKTA authentication configuration SAML
This how-to guide describes how to configure Unit4 Identity Services with OKTA - Saml 2.0.
- Administrative access to OKTA
- Knowledge of OKTA and how to create an OKTA application
- U4IDS authority address (in the rest of this topic we use
https://<address of U4IDS installation>/identityas the address of the U4IDS installation's identity endpoint with sample value
- Access to U4IDS in order to create tenant
The list of official IDS environments can be found here
Setup trust between U4IDS and your OKTA as follows:
- Create a new OKTA Application
- Create a new OKTA application
- Set the redirect URIs
- Get the Entity id
- Get the metadata address
- Register the OKTA application as a tenant in U4IDS
- Select the Unit 4 identity claim type and Name claim type
- Set the authority and idpRegId
Register U4IDS as an application in OKTA
Follow these steps:
Create a new OKTA Application
Create a new Application on your OKTA account by clicking Create Application button in the Applications section.
Select SAML 2.0 as the authentication method.
Give the application a name indicating that it is used for U4IDS authentication.
Set the redirect URIs
Enter the U4IDS acs URL in Single sign on URL field following the pattern
https://<address of U4IDS installation>/identity/AuthServices/acs.
Make sure that "Use this for Recipient URL and Destination URL" is checked.
Tab to Sign On menu and click for the link Identity Provider metadata
It will open new tab with metadata content.
Save the metadata Url as Authority and the entityId as IdpRegId.
Go to the Assignments tab and assign all users which will be able to use SSO as authentication method to your U4F website.
Register the OKTA application as a tenant in U4IDS
After the above steps are done, the collected information may be inserted into the Tenant resource in U4IDS:
See Identity providers in tenants for more information.
Select a unit4IdClaimType
For the unit4IdClaimType claim type the value of email was used but you could use another claim that is unique for a user in OKTA.
Set the idpRegId and idpSecret
authority in IDS is the value of The metadata endpoint from OKTA.
idpRegId of IDS is the value of Entity Id from OKTA.