Overview
Single Sign-On (SSO) is a user authentication process that allows your users to sign in to multiple applications using the same set of login credentials. This allows ease of use for the end users and ease of management for administrators. VIDIZMO offers the most flexible options for you to integrate with a wide range of single sign-on authentication providers, including:
- Directory services such as Azure AD etc.
- Identity Access Management (IAM) services such as Okta, OneLogin, Ping, Centrify,
- Third-party login services such as Facebook, Google, Office 365, Twitter, LinkedIn, etc.
With an app model integration for SSO, VIDIZMO makes the integration as easy as enabling/disabling your identity provider from within the platform administrator interface in minutes. Enterprises using Okta as their identity provider can utilize SSO option with VIDIZMO, allowing users to sign in using the same set of credentials.
For more information about VIDIZMO SSO Apps, read Understanding Single Sign-On.
Before You Start
- For configuring Okta SSO with VIDIZMO, you must have an Okta developer account so that you can create an Okta application. For creating an Okta account, visit https://developer.okta.com/signup/.
- If more SSO Apps have been configured and enabled on your Portal other than Okta SSO, your users will see multiple buttons on the login page allowing them to choose any identity provider of their choice to log in to their VIDIZMO Portal.
- VIDIZMO requires your Okta authorization server to expose a list of scopes to map attributes and provide user authentication. These scopes include:
- Profile (The user's First Name and Last Name are exposed and mapped in your VIDIZMO account in this Scope)
- Email (The user's Email Address is exposed and mapped in your VIDIZMO account in this Scope)
- Phone (The user's Phone Number is exposed and mapped in your VIDIZMO account in this Scope)
- Groups (This is a custom Scope that must be exposed by your Authorization Server. See Adding Custom Scope and Claim to read how to configure it)
- Managers and Administrators of the Portal can configure and enable SSO options in VIDIZMO.
Configuration in Okta
Creating Application
Firstly, you are required to create an application in Okta in order to configure Okta SSO in VIDIZMO. Following steps show you how to create an application in Okta:
I. Go to https://login.okta.com/ and enter your ORG URL that you received while creating your Okta developer account.
IiII. At the Sign In page:
1. Enter your email address and password.
2. Click on Sign In.
III. From the Developer's Dashboard, click on Applications.
IV. From the Applications page, click on Create Add Application.
V. From the Create a New Application integration page:
1. Choose Web as your platform.
2. Choose OpenID Connect as your sign on method.
3. Click next.
VI. From the Create New Application page:
- Specify the Name of the Application.
- Add the logo if you want
- Select the Grant Type
- Enter the Sign-in redirect URL which is your Portal URL concatenated with /sso/signin-okta.
- Enter Sign-out redirect URI which specifies the URI where Okta will send the authorization response. This is your Portal URL with /sso/signout-okta appended at the end.
- Enter Base URLs if you want.
- In Assignment section you can grant the access as per your requirement.
- Select Save to create the application.
You will be directed to your created application:
Assigning Application to Users and Groups
The users and groups that you want to allow to sign in to VIDIZMO using their Okta credentials must be assigned to your created application. Follow the steps to do just that:
I. From the created application's page:
1. Navigate to the Assignments tab
2. Expand Assign to.
3. Click on Assign to People or Assign to Groups depending on whom you wish to assign the created application.
4. Search and select the relevant users or groups and click Done when completed.
Once you've assigned the application to relevant users and groups, you can move on to the next section.
Adding Custom Scope and Claim
By default, Okta's authorization servers expose a number of scopes during user authentication that allow VIDIZMO to map user information from your identity provider to VIDIZMO. As VIDIZMO synchronizes your Okta groups to your VIDIZMO Portal, it is required that you add a custom Scope named groups in the list of scopes exposed by your authorization server. To know more about Scopes and Claims in Okta, read Key Concepts: Scopes, Claims and, Response Types.
To add a custom scope, follow the steps:
I. From the top menu bar:
1. Expand Security.
2. Select API.
II. From the API page:
1. Click on the Edit icon against your default authorization server.
2. Navigate to the Scopes tab.
3. Select Add Scope.
III. A popup Add Scope appears:
- Specify the Name for the scope as groups.
- Enter a relevant Display phrase as shown.
- Enter a relevant Description as shown.
- Select the checkbox for User Consent.
- Select the checkbox for Default Scope.
- Select the checkbox for Metadata.
- Click on Create to add the Scope.
IV. After creating the Scope:
1. Navigate to Claims tab.
2. Click Add Claim.
V. An Add Claim popup appears:
1. Specify a Name for the Claim
2. Specify Include in token type as ID Token and Always.
3. Select the Value type as Groups from the dropdown.
4. For Filter, select Matches regex and specify .* as the condition.
5. Specify the groups scope as created in the previous section under the Include in attribute.
6. Click Create to add the claim.
Once done, you'll be able to see the created claim in the list:
Noting Parameters from Okta
1. Navigate to your created application in the previous section. Under the General tab, you'll be able to see Client Credentials. Copy the Client ID and Client Secret.
2. Navigate to API > Authorization Servers > default, under the Settings tab, copy Metadata URI:
Configuration in VIDIZMO
I. From the Portal's Homepage,
1. Click on the navigation menu on top left corner.
2. Expand Admin tab.
3. Click on the Portal Settings tab and you'll be directed to Portal Settings page.
II. On Portal Settings page,
1. Click on the Apps tab on the left-hand panel.
2. Further click on the Single Sign-On tab.
3. Locate the Okta App on the screen, and click on the Settings icon at the right-hand side.
III. After clicking on the Settings icon, a window will appear which offers various fields, each of which is explained below:
1. SSO Login Message: Enter here the message that you want to display on your portal login screen for Okta login.
2. SSO Login Button Label: The text entered here would display on the button used for Okta login.
3. Client ID: This attribute is the unique identifier for the client application that was created in the previous section.
4. Client Secret: The client secret is used for accessing groups in your Identity Provider (IdP).
5. Meta Address: This is the Metadata URI used to login to the IdP. Enter here the URL of the App that you created in Okta.
6. Requires HTTPS Metadata: Select this check box to get metadata. When the request is handled for the first time, it tries to retrieve some metadata from the authorization server (also called an authority or issuer). This metadata, or discovery document in OpenID Connect terminology, contains the public keys and other details needed to validate tokens.
7. Force Login: Select the checkbox to enable forced login and it will take you directly to Okta. When unchecked, it will not redirect automatically to the IdP and you will be required to sign in through your Portal's sign in screen.
8. Callback Path: Specifies the callback location where the authorization will be sent to your Portal.
9. Scope: A space-delimited list of scopes. OpenID Connect uses scope values to specify what access privileges are being requested for access tokens. The scopes associated with access tokens determine which claims are available when they are used to access the OIDC /userinfo endpoint. The following scopes are supported: openid, profile, email, phone, groups etc.
10. Response Type: Specifies the response type for OIDC authentication. Any combination of code, token, and id_token is used and is an opaque value that can be used to redeem tokens from the token endpoint. In our example, we have used "code" type. The code is returned if the response_type includes code. The code has a lifetime of 60 seconds.
11. Save Tokens: Select to save tokens. You will need administrator privileges to save. API tokens have the same permissions as the user who creates them, and if the user permissions change, the API token permissions will also change.
12. Get Claims From UserInfo Endpoint: Selecting this option returns claims about the authenticated end user if the UserInfo endpoint claims need to be obtained implicitly.
13. Attribute Mapping: Attribute Mapping allows you to map your attributes with the IDP's attributes.
14. Click on the button Save Changes.
A notification will appear stating Portal Information Updated Successfully.
IV. On the Portal Settings > Apps > Single Sign-On screen:
1. Click on the toggle button at the right-side of Okta to enable Okta SSO.
Result
Navigate to the Portal's login screen and you will see an option Login with Okta.
Contributions were made by Perwasha Khan & Sarah Hussain.Read Next
How to Setup SAML-P SSO using Okta
Does VIDIZMO provide Enterprise Grade Security (including Single Sign-On)?