You are viewing an earlier version of the admin guide. For the latest version, please visit EmpowerID Admin Guide v7.211.0.0.

Skip to end of banner
Go to start of banner

Set Up Okta as an Identity Provider

Skip to end of metadata
Go to start of metadata

You are viewing an old version of this page. View the current version.

Compare with Current View Page History

« Previous Version 46 Next »

This article provides a comprehensive guide for configuring EmpowerID to use Okta as an Identity Provider (IdP) through Security Assertion Markup Language (SAML). The configuration enables Single Sign-On (SSO) capabilities, allowing users to access EmpowerID services by authenticating via Okta. In this integration, EmpowerID acts as the Service Provider (SP), and Okta functions as the IdP.

 Prerequisites
  1. Administrative access to the Okta Admin Dashboard.

  2. Administrative access to EmpowerID.

Steps Overview

  1. Configure SAML in Okta

  2. Gather and Verify SAML Attributes

  3. Add Cross-Origin Resource Sharing (CORS) in EmpowerID

  4. Upload Certificate to EmpowerID

  5. Create a SAML Connection in EmpowerID

Step 1 – Configure SAML in Okta

  1. Log in to the Okta Admin Dashboard.

  2. Navigate to Applications.

    • Click "Applications" in the sidebar and select "Applications" from the drop-down menu.

  3. Create App Integration.

    • Click the "Create App Integration" button.

  4. Select Sign-In Method.

    • Select SAML 2.0 and click Next.

  5. Under General Settings, enter an App Name as a minimum and click Next.

  6. Input SAML Settings.

    • Input the following information:

      Input Fields

      Description

      Single Sign-On URL (SSO URL)

      Please provide the SAML endpoint URL in EID for SAML assertion that accepts HTTP POST. Input https://{yourempoweridurl}/WebIdPForms/Generic/AuthenticationResponse as the URL. Replace 'yourempoweridurl' with your organization URL used to access EmpowerID, such as sso.empoweriam.com.

      Recipient URL

      Provide the URL or endpoint where the Okta sends a SAML assertion to the EID during the Single Sign-On process. This URL will be the same as the SSO URL provided earlier; input https://{yourempoweridurl}/WebIdPForms/Generic/AuthenticationResponse as the URL. Replace 'yourempoweridurl' with your organization URL used to access EmpowerID, such as sso.empoweriam.com.

      Destination URL

      The destination URL specifies the destination within the SAML assertion where the SAML response is meant to be delivered from Okta. This URL will be the same as the SSO URL provided earlier; input https://{yourempoweridurl}/WebIdPForms/Generic/AuthenticationResponse as the URL. Please replace 'yourempoweridurl' with the URL used to access EmpowerID, such as sso.empoweriam.com.

      Audience URI (SP Entity ID)

      Provide the specific identifier that serves as the intended recipient of a SAML assertion or response; please input EmpowerID. This should be the same when we specify the SP Name Qualifier later while configuring the SAML connection in EmpowerID.

      Name ID format

      Leave Unspecified for the Name ID Format.

      Application User Name

      You must provide their identifier or username to identify a user within a specific application or service. In the case of EmpowerID, you should select the AD SAM account name. To make this possible, you must create the attribute mapping for the AD SAM account name in your Active Directory in Okta. Once you have done that, you can choose the field here.

  7. Review Configuration

    • Click Preview SAML and verify the settings.

    • Click Next and fill out the Feedback form if desired.

    • Click Finish.

Step 2 – Gather and Verify SAML Attributes

  1. Retrieve SAML Setup Information.

    1. Navigate to the details of the newly created application in Okta.

    2. Click on the SAML tab and then View SAML Setup Instructions.

    3. Obtain the following information:

      • Identity Provider Single Sign-On URL

      • Identity Provider Issuer URL

    4. Download the signing certificate.

Step 3 – Add CORS in EmpowerID

  1. Configure CORS Settings

    • You need to configure EmpowerID's Cross-Origin Resource Sharing (CORS) settings to allow Okta's URL to interact with EmpowerID. The URL that you need to add is your Okta URL (also called an Okta domain). Please follow the EmpowerID documentation for CORS configuration here: Configure Web Security Settings.

  2. Recycle the Environment.

    • CORS settings are cached; therefore, recycle the EmpowerID environment for changes to take effect.

Step 4 – Upload Certificate to EmpowerID

To configure the authentication request, you must upload the certificate signing certificate that you had previously downloaded from the Okta platform. This certificate will be used as the signing certificate.

  1. Navigate to SSO Components.

    • From the navigation bar, go to Apps and Authentication > SSO Connections > SSO Components.

  2. Upload Certificate.

    1. Click on the Certificates tab and the (plus) icon to upload a new certificate.

    2. Select Upload Certificate, choose the Certificate Owner, and then upload the certificate downloaded from Okta.

  3. Click Save.

Step 5 – Create a SAML Connection in EmpowerID

  1. On the navbar, expand Apps and AuthenticationSSO Connections and click SAML.

  2. Click the Add New (blue star) icon.

  3. Fill in the required fields as outlined in the table below:

    Input Fields

    Description

    Name

    Provide a unique and descriptive identifier for the connection.

    Display Name

    Please provide a clear and easy-to-understand label that will appear in the application's user interface to represent the connection.

    Name Identifier Format

    Please select the format and structure of the unique identifier for the SAML assertion subject. This identifier represents the user or entity to which the SAML assertion refers. For Okta integration, select Unspecified.

    SAML Submission Method

    Please choose the appropriate HTTP method to send SAML requests. Select HTTPPost for Okta integration.

    Level of Assurance

    If you use multifactor authentication and want to adjust the default Level of Assurance points for the connection, enter a new value in the Level of Assurance (LoA) field. For example, if the level of assurance (LOA) is set to two, the user will be required to complete at least two multifactor authentications.

    Issuer

    The issuer URL, or Issuer Endpoint, is a specific web address or URL provided by the Identity Provider for SAML. Please Enter the Identity Provider Issuer URL from the application you configured in the Okta Platform.

    Initiating URL

    The URL that initiates the SMAL request from EmpowerID. The default value is "/WebIdPForms/Generic/AuthenticationRequest."

    Tile Image URL

    Please provide a URL for the image to serve as the icon representing the Single Sign-On (SSO) connection on the login screen.

  4. Under Identity Provider URL Details, Enter the Identity Provider Single Sign-On URL from the Okta SAML application integration.

  5. Under Logout URL, enter the Logout URL and the Logout SAML HTTP Protocol used.

    • The Logout URL is the Single Logout (SLO) URL provided by Okta. This URL will handle the logout process, ensuring the user's session is terminated in both EmpowerID and Okta.

    • The Logout SAML Protocol is the HTTP method to send SAML requests. To configure Okta in EID, please select the HTTPPost option.

  6. Under Account Information, select whether to create a new Account Directory or to select an existing Account Directory.

  7. Under Certificates, please provide the necessary information related to the Certificates for the SAML connection.

    • The Signing Certificate is used by the IdP to digitally sign the SAML assertions and messages it sends to the SP. When receiving these messages, the SP can use the IdP's signing certificate to verify the message's integrity and authenticity. It should be the public key.

    • The SP uses the Verifying Certificate to verify the digital signatures on SAML assertions and messages the IdP sends. The SP uses the verifying certificate to ensure that the trusted IdP genuinely signs the messages it receives and that they haven't been altered or forged.

  8. Click on the Authn Request tab and select Create a New Authentication Request. You have the option to create a new one or use an existing SAML Authentication Request. Enter the required details to create a new authentication request and click on Save.

    Input Fields

    Description

    SP Name Qualifier

    A unique identifier associated with EmpowerID, input EmpowerID. This should be the same to what we specified in the Audience URI while configuring the SAML application in Okta.

    Assertion Consumer URL

    This URL is the endpoint where SAML assertions are sent from successful authentication and authorization by OKTA or the SP to EID or the IdP. Use https://{yourempoweridurl}/WebIdPForms/Generic/AuthenticationResponse as the URL. Replace 'yourempoweridurl' with the URL used to access EmpowerID, such as sso.empoweriam.com.

    Submission Method

    Please choose the appropriate HTTP method to send SAML requests. Select HTTPPost for Okta configuration.

    Issuer Name

    Identifier that specifies the entity that issued a SAML assertion or message. Please enter the https://{yourempoweridurl}/ that you use to access EmpowerID. Please replace 'yourempoweridurl' with the URL used to access EmpowerID, such as sso.empoweriam.com.

    Signing Certificate

    The signing certificate contains a public key used to sign the SAML assertion digitally. Please choose the EID Federation Certificate as the signing certificate.

    Verifying Certificate

    A verifying Certificate is used by the receiving party to verify the digital signature on a SAML message. Please choose the Signing Certificate you obtained from Okta app Integration and upload it to EID earlier in step #4.

Step 6 – Testing the Configuration

Test the configuration by logging in to EmpowerID using Okta credentials.

  • No labels