Okta SAML SSO Configuration

This guide demonstrates the step-by-step process for creating a new application in Okta capable of communicating via SAML 2.0 with Axur Platform services. In this guide, we will cover all the necessary configurations to ensure that Single Sign-On (SSO) works correctly and as expected.

In all Axur Platform SSO application creation tutorials, there is the concept of users and groups. After all, the provider is where all your user information will be stored, in addition to the groups to which they belong (creating groups via the provider is optional). In this sense, this section is dedicated to teaching how to create groups and users in Okta, as well as assigning users to groups.

Follow the step-by-step instructions in the images to create a new group:

For the Axur Platform to recognize them correctly via SAML, it will also be necessary to create groups with the exact names that the platform expects, as shown in the table below. Later, we will create a mapping between them.

This strategy is useful for organizational purposes. The first groups you created (e.g., Axur Platform Viewer) can be easily identified as belonging to the Axur Platform in your Okta searches. Later, you will see that we will create a mapping so that whenever we receive a login from a user in the Axur Platform Viewer group, for example, the group transmitted to the platform is converted to its respective desired group (one-viewer in this case).

To assign a group to a user you created, follow the step-by-step instructions in the images:

Add as many users as you like.

With access to the Okta Dashboard, follow the step-by-step instructions in the images to create a new application. The process is sequential, but we are dividing it into sections to improve understanding. It is a simple and easy-to-follow interface.

It is necessary for Okta to know who it will be communicating with for the SSO process to work smoothly.

In this sense, the first section of the app creation asks for some data that refers to the Axur Platform so that we can communicate via the SAML protocol.

These are the data you will need (These values are fixed and must be entered exactly as shown):

Fill in the fields as indicated in the image. Ensure that all values shown in the example image are filled in, including the Name ID format and Application username fields, in addition to those listed in the table above. Other fields not indicated can usually be left with their default values or empty, unless your organization has specific requirements.

By using Okta as our provider, we are leveraging the credentials that are already stored and managed by Okta, and these credentials are stored in the format defined by the provider. However, to communicate with the Axur Platform using SAML, it’s necessary that user data is sent in a standardized way. Think of it this way: We need to ensure that the Axur Platform always receives the user’s email attribute in the same format regardless of whether this data comes from Okta or any other provider. Different providers store their data in different ways, and mappings solve this problem!

Continue in the new application creation menu, and use the values indicated in the table to fill in the user attribute mapping section. Enter the first value (Name) manually, as it is a URL. The other fields can be selected from the dropdown. Simply ensure that the values in your application match those in the image!

If you decided not to create groups in Okta for this application, do not fill in the group mapping values that may appear below this user attributes section. Continue the new app creation process, clicking the appropriate button to proceed. Okta may present a final feedback step, which is usually optional and can be skipped. After that, you can finalize your app creation process.

Just like user attributes, we also have groups, which bring users together according to some specific criteria. These groups are created by the administrator in Okta, and as explained in the previous section, it is necessary to create a mapping so that this data is transmitted to the Axur Platform in a standardized way, regardless of the provider.

Follow the images to create group mappings in the Okta settings, and use the values from the table to perform your configuration:

The pattern (one-.*) ensures that any group matching the expected Axur Platform suffixes (e.g., one-viewer, one-manager) is included.

Continue the new app creation process, clicking the appropriate button to proceed. Okta may present a final feedback step, which is usually optional and can be skipped. After that, you can finalize your app creation process. For group attribute mapping to work correctly, one more thing will be necessary.

In the group creation section, you created two groups for each existing profile on the Axur Platform (e.g., Axur Platform Viewer -> one-viewer). Now we will create a rule that automatically associates users from the first group to the second, so that everything works normally on the platform. Follow the step-by-step instructions in the images to do this:

Since we are using Okta as our identity provider, it is necessary to obtain some information that can tell the Axur Platform who it will be communicating with and whether its information is secure and reliable.

When accessing your application created for the Axur Platform, click on the Sign On tab. As shown in the photo, you can see a section with a URL indicating where the provider’s metadata is located so that we can use it later in the tutorial. Copy this link and save its value in a note so that we can use this data later.

Now all that remains is to assign users or groups to the new application you created. Follow the step-by-step instructions in the images to do this.

For group:

This concludes the necessary configurations in the Okta provider. Return to the configuration guide on the platform to finalize the creation of your application.