Use Okta SAML as an Identity Provider (IdP)

Hands-on guide on how to configure an Okta custom SAML application as an IdP for Azion's platform.

View as Markdown

The Okta Identity Provider (IdP) is a trusted entity that allows you to enable single sign-on (SSO) to access other sites or services, such as Azion. Your users can continue using their corporate user identities without having to remember a specific password or enter credentials each time they access Azion’s platform.

To set up an Okta custom SAML app as your account IdP for Azion, follow the next steps.

Configuring the SAML app on Okta Admin Console

  1. Log into the Okta Admin Console.
  2. On the homepage, under Applications, select Applications.
  3. Click Create App Integration.
  4. On the modal, select the option SAML 2.0 and click Next.
  5. Name the application. Example: Azion SAML.
  6. Click the Next button.
  7. In the General section, fill in the Single sign-on URL field with a temporary URL. The correct URL will be provided later in Azion’s platform. Example: https://sso.azion.com.
  8. Repeat the previous step for the Audience URI (SP Entity ID) field.
  9. Scroll down to the Attribute Statements section and fill in the fields as follows:
    • Name: email
    • Name format: Basic
    • Value: user.email
  10. Click the Next button.
  11. Fill in the Feedback section as required.
  12. Click the Finish button.

You’ll need to save some metadata generated by Okta that will be required when you create an IdP in Azion’s platform. Launch a text editing application to temporarily store the data and follow the steps below.

  1. After you’re redirected to your app details, click the Sign On tab.
  2. Under Metadata details, click More details.
  3. Copy the following metadata and paste into the text editing application:
    • Sign on URL, in the format https://account-name.okta.com/app/app-id/sso/saml.
    • Issuer, in the format http://www.okta.com/app-id.
  4. Scroll down to the SAML Signing Certificates section and find the active certificate or generate a new one.
  5. For the active certificate you want to use with Azion’s platform, click Actions > View IdP metadata.
  6. Copy the value within the XML tag <ds:X509Certificate> and paste into the text editing application.

Configuring the Identity Provider on Azion

You must be the Account Owner on Azion’s platform to perform these settings.

  1. Access Azion Console.
  2. On the upper-right corner of the page, select the avatar menu. This is the Account menu.
  3. Select SSO Management.
  4. Click the Add Identity Provider button and select SAML.
  5. On the Identity Provider page, choose a name that identifies your identity provider. Example: Okta IdP SAML.
  6. Fill in the following fields with the data copied from the Okta Admin Console:
    • Identity provider’s Entity ID URI: add the Issuer URL.
    • Sign-in URL: add the Sign on URL.
    • Certificate: add the downloaded certificate, including the -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- tags.
  7. Click Save.
    • You’ll be redirected to the list of identity providers, where you can view all the providers created in your account.
  8. To connect the Console IdP with the Okta custom app, click the three dots on the corner of the IdP card and select Edit.

Completing the registration of the app on Okta Admin Console

  1. In the Okta Admin Console, access the app created to apply SSO in Azion’s platform and navigate to the General tab.
  2. Scroll to the SAML Settings section and click Edit.
  3. Click the Next button.
  4. Copy the value of Assertion Consumer Service URL generated by the IdP and paste it in the field Single sign-on URL in Okta.
  5. Copy the value of Service Provider’s Entity ID URI generated by the IdP and paste in the field Audience URI (SP Entity ID) in Okta.
  6. Click the Next button.
  7. Click the Finish button.

Adding users on the Okta SAML app

  1. In the Okta Admin Console, access the app created to apply SSO in Azion’s platform and navigate to the Assignments tab.
  2. To assign users to the SAML app, click the dropdown button Assign and select Assign to People.

You can also create a group for Azion users in Okta to facilitate SSO management.

  1. Click Assign for the users you want to add from the list.
    • The email configured in Okta must be the same email registered for the user in Azion’s platform.
  2. Click the button Save and Go Back.
  3. Repeat the previous steps for each user that you want to activate the SAML app for Azion’s platform.

Turning on the Identity Provider on Azion

  1. Back on Console, access the SSO Management page.
  2. On the box of the Identity Provider you’ve added, click Activate and turn on identity Origin and then click Confirm.

Now all the users of the account, except for the Account Owner, will be able to access Console using Okta as the Identity Provider.

When the IdP app is activated, the Multi-Factor Authentication (MFA) stops being verified by Azion’s platform and starts to be authenticated by the IdP. If the account returns to Azion’s SSO, it’ll use the last active status of the MFA.