Okta as the identity provider for SSOGEN

SAML

1. In SSOGEN, start the setup and copy the SP entity ID and ACS URL (Add a SAML identity provider in SSOGEN, section 1). Choose the Okta card, then SAML.
2. In the Okta Admin Console, open Applications > Applications and select Create App Integration. Choose SAML 2.0 and Next.
3. General Settings: name the app, for example SSOGEN, and select Next.
4. Configure SAML:

5. Under Show Advanced Settings, leave Assertion Signature at Signed. SSOGEN requires a signed assertion.
6. Under Attribute Statements, add email with the value user.email, and displayName with the value user.displayName. (In orgs that manage claims on the Sign On tab, add them there with Add expression after the app is created.)
7. Select Next, answer the feedback page as an internal app, and select Finish.
8. On the app’s Assignments tab, select Assign and assign the people or groups who may use SSOGEN.
9. On the Sign On tab, copy the metadata URL shown there, or under SAML Signing Certificates open Actions on the active certificate, choose View IdP metadata and save the XML as a file.

Okta’s issuer has the form http://www.okta.com/<id>. SSOGEN accepts it as it is.

OpenID Connect

1. In SSOGEN, choose the Okta card, then OpenID Connect, and copy the Redirect URI from Client credentials, for example https://acme.ssogen.ai/oidc/rp/okta-oidc/callback (Add an OpenID Connect identity provider in SSOGEN, section 2).
2. In Okta, Applications > Applications > Create App Integration, choose OIDC - OpenID Connect and the application type Web Application, then Next.
3. Name it, keep Authorization Code ticked under Grant type, and add the redirect URI under Sign-in redirect URIs. Leave wildcards off.
4. Under Assignments, choose Limit access to selected groups and name the group, or skip and assign later on the Assignments tab. Select Save.
5. On the General tab, under Client Credentials, copy the Client ID; keep Client secret as the client authentication and copy the secret. Ticking Require PKCE as additional verification is fine: SSOGEN always uses PKCE.
6. The issuer is your Okta org address, for example https://<your Okta domain>, with no trailing slash. Open https://<your Okta domain>/.well-known/openid-configuration and copy its issuer value to be sure. If your org uses a custom URL domain, use the issuer shown in the app’s Sign On tab.

Okta decides who reaches SSOGEN through the app’s assignments. In SSOGEN, a new provider admits only people already linked to it, which on day one is nobody. Choose one of these on the provider’s Configuration tab, Sign-in restriction:

• Anyone this provider vouches for (a new account is created): each assigned person gets an SSOGEN account at first sign-in. Over SAML the account is named after the NameID, for example okta_john.doe_acme.example; over OpenID Connect it takes Okta’s preferred_username, for example john.doe@acme.example.
• If people already have SSOGEN accounts, a Super admin turns on account matching by email address. That needs a required claim and a verified email signal from Okta; see section 6 of the SAML or OpenID Connect page.