Introduction

This document provides instructions to configure the Security Assertion Markup Language (SAML) - Okta IDP profile in the Tenant Admin Portal.

Prerequisites

You must have admin access to the Tenant Admin Portal.
Ensure that the SAML IDP application is created. To create SAML application, refer How to Create IDP Profile for Security Assertion Markup Language (SAML) in the Tenant Admin Portal | Oloid Help Center.
The required Okta SAML parameters must be available in the Okta Admin Console. For more, refer to How to Configure Security Assertion Markup Language (SAML) IDP in OKTA Admin Console | Oloid Help Center.
A WebKey application must be created. For more, refer to How to create and configure WebKey Application in Tenant Admin Portal | Oloid Help Center.

Steps to Configure SAML-Okta IDP Profile

Log in to the Tenant Admin Portal.
On the home page of the portal, click Security > Identity Provider on the left menu panel.

The Identity Provider Profiles page is displayed.
Click preferred SAML-IDP application.

The IDP details page is displayed.
Do the following:
The IDP Profile is configured successfully.

Configure Details Tab

The Details tab is used to view and manage the basic information for the Okta SAML identity provider configured in the Tenant Admin Portal.

To configure the Details tab, do the following:

Edit the IDP Name (if required).
Enter Description (optional).
Do one of the following:
1. Select the required WebKey application from the Select WebKey Application drop-down list.
  
  (OR)
2. Click Make Default.
  Note: The Make Default button is enabled only when more than one IDP is added in the Tenant Admin Portal.
  
  The Set this as Default IDP pop-up box is displayed, do the following.
  - Select the Webkey Application from the drop-down.
  - Click Set as Default.
    
    Note: If another IDP is currently set as default, it will be replaced upon confirmation.
    To make IDP as default, click Make Default. The confirmation pop-up box is displayed.
    Click Set as Default to designate the preferred IDP as default.
  The WebKey application is linked to the IDP.
Click Save.

The Linking IDP to Application pop-up box is displayed.
Click Confirm Action.

The Details tab is configured successfully.

Configure Oloid Metadata Tab

The Oloid Metadata tab is used to provide the required information to configure SAML settings and enable SAML-based authentication between the identity provider and the Tenant Admin Portal.

Click Oloid Metadata tab.
The Oloid Metadata tab is displayed.

Note: Click Visit help page for the document to configure Okta settings for SSO login.
Do the following:
1. Download Certificate: Download the certificate and upload it to the IdP Signature Certificate field.
2. Sign-On URL: Copy the Sign-on URL and enter it in the IdP Issuer URL field.
3. Entity ID: Copy the Entity ID and enter it in the Sign-on URL field.
  
  Note: You can find the IdP Signature Certificate, IdP Issuer URL and Sign-on URL fields on the SAML protocol section on SAML in OKTA Admin Console. For more details, click here.
The Okta settings are updated with the Oloid metadata.

Configure IDP Settings Tab

The IDP Settings tab is used to configure and upload the required SAML details to enable authentication between the identity provider and Tenant Admin Portal.

To configure the IDP settings tab, do the following:

Click the IDP Settings tab.

The IDP Setting tab is displayed.
Do one of the following to configure the IDP Settings tab.
1. Upload Metadata file.
  
  OR
2. Enter Entity ID.
3. Enter ACS URL.
  
  Note: You can find the Metadata file, Entity ID and ACS URL on the SAML application details page. For details, click here.
4. Select Name ID Format from the drop-down.
  Note: By default, Email Address is selected.
5. Select SAML Subject from the drop-down.
  Note: By default, Email is selected.
6. Enter Home URL: Enter the URL of the home page.
7. Enter Home Button Label: Enter the text displayed on the Home button.
8. Click Save.
IDP settings tab is configured successfully.

Configure Claims Tab (Optional)

The Claims tab is used to configure custom claims that pass user attributes from Oloid to the SAML provider.

Click the Claims tab.
The claims tab is displayed.
Do the following:
- Additional Claims
- Group Claims

Additional Claims

Additional Claims allow the admin to map Oloid user attributes to SAML attributes.

Do the following:

In the Additional Claims section, click Add Field.
In the SAML Claim field, enter the claim name to be sent to the service provider.
Select one of the following types.
- Basic: Standard claim format.
- Unspecified: No specific format defined.
- URI Reference: Claim uses a URI-based format.
In the Oloid Value dropdown, select the corresponding Oloid attribute (for example, Oloid ID).
Note: Click Add Field to add additional claim items.
Click Save.

The Additional claims section is configured successfully.

Group Claims

The Group Claims section allows you to pass user group-related attributes from Oloid to the Service Provider during authentication.

In the Group Claims, expand the Group Claims section.
The Group Claims section is displayed.
Click Add Field.
Enter the following details:
1. Attribute Name: Enter the group attribute name to be sent to the Service Provider.
2. Type: Select the claim format:
  1. Basic
  2. Unspecified
  3. URI Reference
3. Oloid Value: Enter or select the group-related value.
4. Condition: Select one of the following:
  1. Contains
  2. Equal
  3. Starts With
Click Save.

The Group Claims section is configured successfully.

The SAML IDP is successfully configured.