Installing and Configuring the Okta Module

The Okta Module allows Decisions to integrate with Okta and adds new Okta-specific steps. This lets Decisions create and modify Okta accounts through Flows created in Decisions, along with enabling single sign on (SSO).

The Okta Api Token can be retrieved from Okta's platform by navigating to Security > API > Tokens > Create Token. The Okta module uses the SAML module therefore changing the Okta settings actually passes the values through to the SAML setting. Okta is a single specific provider whereas SAML is the protocol that is used by hundreds of different providers.

Note that unlike most modules in v9, Okta and other identity provider modules can be found and installed from System > Security > Identity Providers.

Settings Configuration (Okta)

1. Create a new application. Select SAML 2.0.

2. After the app is created configure the endpoints.

For this screenshot an example SSO URL is used. Users should follow one of two templates depending on if they are self-hosted or IIS hosted.

For self-hosted installation use this template: [base]:[port]/SAML/AssertionConsumer 

For IIS installations use this template: [base]/{virtual directory}/SAML/AssertionConsumer

3. The Attribute Statements and Group Attribute Statements are optional and do not need to be filled out. 

4. Options on tab 3 Feedback do not affect Decisions integration.

Settings Configuration (Decisions) - OKTA MANAGEMENT SETTINGS

The Okta Settings within Decisions have two components - OKTA MANAGEMENT SETTINGS and OKTA SSO SETTINGS

Once Okta setting are configured within Decisions, the SAML module will also be updated.

1. Navigate to System > Settings. Click Okta Settings and select Edit.
   
   
2. On the Edit Okta Settings window, add the Okta Subdomain or URL and Okta Api Token. After configuring all necessary options, click SAVE. Everything under OKTA MANAGEMENT SETTINGS is used for the Okta Sync Flows that come with the module. This section is not required for the SSO Login process.

   Setting	Description
   Okta Subdomain or URL	The Okta Subdomain or URL used to return SSO requests.
   Okta Api Token	The Okta API Token used to authenticate requests.
   Sync Okta User Flow	A Flow designed with the Okta Sync User Flow behavior used to sync and create new Decisions accounts based on data retrieved from Okta.
   Sync Okta Group Flow	A Flow designed with the Okta Sync Group Flow behavior used to sync and create new Decisions groups based on data retrieved from Okta.
   Sync Only Chosen Groups	Syncs only specific groups retrieved from Okta. The group list will display after the other settings are complete.
   Enabled	If enabled, allows SSO settings to be defined for the Okta integration. These settings will overwrite the settings defined in the SAML module.

   

OKTA SSO Settings

1. Check the “enabled” checkbox. This will display the settings. 

2. Enable “Quick Configuration with Metadata”. This will allow the use of a meta URL from Okta to get the configuration data automatically. 

1. In Okta, navigate to the Application. Go to the “sign-on” tab.
2. Right click the “Identity Provider Metadata” link and copy the link. Paste that into the Metadata URL field.
   

3. Fill out the following settings:

SP Issuer ID: This will be the "audience URL (SP entity ID)" from the Okta Application Setting within Okta. This must match exactly.

Name ID Format: By default this will be set to Email. If using persistent/transient then change that from the drop down. This will be the "Name ID Format" setting from the Application Setting on Okta.

Related Flows

The Okta module adds four Flows to the System > Designers > System Defaults folder. Three of them are Subflows used in the Flow Sync Okta Users, Groups, and Roles. Setting the Sync Okta Users, Groups, and Roles to be a scheduled job daily is highly recommended. This will keep accounts in Okta and Decisions coordinated without extra work.

Related Steps