Setting up SAML Single Sign On with OKTA

This article is to be used in conjunction with Adding a New SAML Authenticator & Enabling Single Sign On

The steps below outline how to setup SSO between IntelligenceBank and Okta using the generic SAML 2.0 custom app setup.

An IntelligenceBanK SSO Application for Okta is also directly available when browsing through the Applications list. Steps are similar though simplified as unnecessary options will not appear. You can find the Okta documentation here.

IN OKTA

1. Sign in to Okta as an Administrator.
2. Navigate to and click on Applications on the navigation menu.
3. Click Create New App, and select SAML 2.0 as 'Sign on method' value.
   
   
   
   
4. Give the app a recognizable name, e.g. IntelligenceBank SSO. Click Next.
5. Under 'Single Sign On URL', input your IntelligenceBank domain URL, appending /auth at the end of it.
6. Under 'Audience URI (SP Entity ID)', enter a custom name value for this integration. This value will be used later in IntelligenceBank under ServiceProvider. e.g. IntelligenceBank
   
7. Click Next.
8. Provide Feedback to Okta on the last step as needed and Save your App.
   
   
9. You should now see your app listed. Click on it.
10. Go to Sign On, and click the View Setup Instructions button. Keep this page open when setting up IntelligenceBank as per steps below.
    
    
    
11. Once IntelligenceBank is setup, you can assign the users that should have access to the IntelligenceBank SAML App.

IN INTELLIGENCEBANK

1. Go to the Authenticator module area, located at https://myintelligencebankdomain/auth.
2. Click Add New.
3. Copy and paste the 'Identity Provider Single Sign-On URL' (1) value (retrieved from the View Setup Instructions page) into the 'RemoteURL' field.
4. Copy and paste the 'Identity Provider Issuer' (2) value (retrieved from the View Setup Instructions page) into the 'Name' and 'Host' fields.
5. Copy and paste the X.509 Certificate value (also retrieved from the View Setup Instructions page) WITHOUT the BEGIN and END CERTIFICATE parts, into the 'CertData' field.
6. Enable Base64Attributes.
7. Enter the 'Audience URI (SP Entity ID)' entered previously in Okta into the 'ServiceProvider' field.
8. You can enter your Organization name into the 'OrganizationName' and 'OrganizationDisplayName' fields (optional).
9. Enter a logout action destination URL (optional) into the 'SingleLogoutService' field. e.g. https://ssodemo.intelligencebank.com/logout
10. Save.
11. When ready to turn the Authenticator on, update it to "Disabled" = Off. All users will be enabled as SSO Users by default. To disable SSO authentication for select users, go to their user profile under Admin > Users, and enable the IntelligenceBank Login option.