Okta SAML Integration

This article provides a step-by-step guide for integrating Okta as an external Identity Provider for authentication within the Safous ZTA service. Before you begin, please ensure that you have an Okta Workforce Identity Cloud account with administrative privileges.

Setup Okta SAML Application in Okta Admin Console

1. Login to your Okta tenant admin console (e.g. https://<tenant>.okta.com/admin/apps/active)
2. Proceed to create a new app integration, and select SAML 2.0
   
3. Input your App Name and click Next
4. Fill in "Single sign-on URL" and "Audience URI" with these details:
   1. Single sign-on URL: https://login.<tenant>.ztna.safous.com:443/v1/auth/saml/1/callback
   2. Audience URI: the app name that you inputted previously in step 3
      
5. Configure Name ID Format and Attribute statements as below
   
6. You can check the attribute statement by clicking Preview the SAML Assertion. 
   
   If the attribute is right, then you can proceed by clicking Next.
7. In the Feedback section, fill in both questions and Click Finish.
   
8. In the application you just created, navigate to the Assignments section to designate the specific users or groups that you want to grant access to the app.
   
9. Please make sure to change user authentication policy into Okta Dashboard, to disable the MFA of the Okta login page since we only want to use Safous MFA. You can find this configuration on the Sign On tab and scroll down to edit the user authentication option.
   
   
10. After that, still on the Sign On tab click View SAML setup instructions. We'll use the information in the instructions to set up IdP in your Safous Admin Portal.
    
    
    
11. In SAML setup instructions you can take note of these values that will be needed for configuring IdP in the Safous Admin Portal.
    • Identity Provider Single Sign-On URL, which is the SSO URL.
    • Identity Provider Issuer, which is the SSO Issuer.
    • X.509 Certificate, which is the CA Trusted Certificate.

--------------------------------------------------------------------------------------------

Setup IdP in Safous Admin Portal

1. Login to Safous Admin portal
2. Navigate to Settings > ZTNA > Configurations > Identity Provider. Click New IdP, it will expand the form of IDP which you will need to configure.
   
3. Fill in the name and ensure that the status of the IdP is enabled (green).
   
4. Choose SAML for the Identity Provider Setting.
   
5. Fill in "Entity Issuer" with the Audience URI from your Okta Application
   
6. Fill in "SSO Issuer" with Identity Provider Issuer that you previously took notes on.
   
7. Fill in "SSO URL" with Identity Provider Single Sign-On URL that you previously took notes on.
   
8. Fill in both required "Username attribute" and "Email Attribute" with your Attribute configuration in the Okta Application. In this example, we're using Email. You can also optionally map other attributes by matching it with your attribute configuration in the Okta application.
   
   
9. Fill in "CA Trusted Certificate" with X.509 Certificate that you previously took notes on.
   
10. For the rest of Safous ZTNA SAML configuration please refer to here.
11. Once you are done with the configuration, click Save.
    
    
12. The page will display notification to inform you that the IdP has been added successfully.
    
13. Verify your Redirect URI is correct by comparing it with the Single Sign On URL in your Okta Application.
    
    
14. If the Redirect URI is the same as the Single Sign On URL in your Okta Application, you can leave it as it is. But if it's not, then please change the Single Sign On URL in your Okta Application by accessing this section:
    Your Okta Application > General > SAML Settings > Single Sign On URL.
15. If everything is configured correctly, you can log in to the user portal (https://login.<tenant>.ztna.safous.com) and choose to log in With IdP, where you will see your Okta SAML configuration.