Okta Configuration

Create App Integration

1. Navigate to Applications on your Okta Admin Dashboard, and click "Create App Integration"

   

2. Select Sign-in method "SAML 2.0", and click "Next"

   

3. In "App name" enter a name for your integration (e.g. EasySSO Jira), and click "Next"

   

4. Under "Single sign on URL", enter your EasySSO Endpoint URL - found in your EasySSO SAML configuration screen.

5. Under "Audience URI", enter your EasySSO Entity ID - found in your EasySSO SAML configuration screen.

   

(Optional) Enable message signing and verification

1. Click "Show Advanced Settings", change the Signature Algorithm to "RSA-SHA1", and the Digest Algorithm to "SHA1"

   

2. In the EasySSO Configuration screen, ensure "Enable SAML" is checked

   

3. Go to the Certificates tab, and under SP Signing Certificate click "Generate Certificate"

   

4. Copy the certificate and paste it into a new certificate file on your computer (e.g. spsigningcertificate.crt)

5. Upload the SP Signing Certificate file to Okta using the "Browse files..." button next to "Signature Certificate"

6. Click "Allow Application to initiate Single Logout"

   

7. Copy and paste the EasySSO Endpoint URL in the "Single Logout URL" field

8. Copy and paste the EasySSO EntityID in the SP Issuer field

9. Enable "Validate SAML requests with signature certificates"

   

Configure Attribute Statements

1. Under Attribute Statements, add the following statements:

   

   1. Username

      1. Name: urn:oid:0.9.2342.19200300.100.1.1

      2. Name Format: Unspecified

      3. Value: user.login

   2. Email

   1. Name: urn:oid:0.9.2342.19200300.100.1.3

   2. Name Format: Unspecified

   3. Value: user.email

   3. First Name

      1. Name: urn:oid:2.5.4.42

      2. Name Format: Unspecified

      3. Value: user.firstName

   4. Last Name

      1. Name: urn:oid:2.5.4.4

      2. Name Format: Unspecified

      3. Value: user.lastName

2. At the bottom of the page, click Next

3. Select "I'm an Okta customer adding an internal app"
   

4. Click Finish

EasySSO Configuration

Configuration with Metadata URL

1. Click the "Sign On" page of your Okta Application
2. Click "Copy" under the Metadata URL - Note: you can click "View SAML setup instructions" to also find this URL, as well as the variables and metadata to configure EasySSO manually
   
3. Visit the EasySSO SAML configuration screen, and make sure "Enable SAML" is ticked
4. On the "Certificates" page, ensure "URL" is selected for "Load Metadata"
5. Paste the Okta Metadata URL in the "Idp Metadata URL" field, and click "Load Certificate" to load the metadata
   
   
6. Metadata values will be loaded across EasySSO. On the General page:
   
   1. Set the "Login Binding Type" to either "POST" or "Redirect" - the Binding URL should have been configured by the Okta metadata
   2. Set the "Logout Binding Type" to "POST", "Redirect", or "Disabled" - if the Logout Binding Type is not Disabled, the Logout URL should have been configured by the Okta metadata
   3. Set the "Entity ID" to the "Identity Provider Issuer" URL under step 2 of the Okta Setup Instructions page
   4. (Optional) Visit EasySSO SAML Message Signing and Verification for signing and verification configuration options
   5. Press "Save" at the bottom of the page
      

Encrypted Assertions (Optional)

EasySSO Service Provider

1. Open the EasySSO Admin page
2. Click the SAML button to be taken to the SAML Admin configuration
3. Check the 'Encrypt Assertions' check box
4. Click the Save button at the bottom of the page to save the updated configuration
5. Click the 'Certificates' tab
6. Copy the contents of the sp certificate text box into a new file and save it with the name of 'myeasyssosp.crt'

In Okta

1. Open your SAML Administration page
2. Open the SAML Client configuration
3. Click the Assertion Encryption dropdown and select 'Encrypted'
   
   1. Set Encryption Algorithm to AES256-GCM
   2. Set Key Transport Algorithm to RSA-OAEP
4. Upload the SP Certificate file previously saved ('myeasyssosp.crt')
   
   
   

More Configuration

You've completed the configuration of EasySSO SAML with OKTA!

For more customisation options, check out EasySSO with SAML - Configuration.