Configuring SSO for Okta OIDC

What is OpenID Connect (OIDC)?
A simple identity layer on top of the OAuth 2.0 protocol is OpenID Connect 1.0. Based on the authentication carried out by an Authorization Server, it enables clients to acquire basic profile information about the End-User in an open and REST-like manner. The authentication includes the Client ID, Redirect URL, ACS URL, Logo, two-factor authentication (mail and OTP) and actions.
In the Summit portal, Admin can configure SSO for OIDC from the Okta SSO configuration page and enable the OIDC capability for logging into different applications. It enables seamless login into several web applications and secures the online identity of businesses and customers.

Benefits

• Lowers the potential for password security breaches.
• Speeds up sign-up procedures.
• Grants greater control on online identity.
• Sets a single primary account to sign into various websites.

Configuration in SymphonyAI Summit Application

Before performing SSO configuration, the Admin to add a value named email and map under the Master type OAuthResponseKey.
Configuring OAuthResponseKey under Common Master for Response Attributes*Configuring Master type *OAuthResponseKey under Common Master - Response Attribute

To configure Discovery Protocol, perform the following steps:

1. Select Admin > Basic > Infrastructure > Common Masters > Common Master Configuration.
2. On the COMMON MASTERS page, click ADD NEW on the ACTIONS panel.
3. Select the Master Type as OAuthResponseKey from the drop-down list and enter the Value as email in the text field. (The value (email) specified is all small letters and not plural)
4. Type in the Sort Order. Select the Active check box to make it an active master value.
5. Click SUBMIT. A new Common Master value is configured for OAuthResponseKey.

Figure:  Common master - OAuthResponseKey

Field Description

The following table describes the fields on the COMMON MASTER TYPES page:

For more information about Common Master configuration, see Configuring Common Master Types.


Prerequisites to be performed in Okta Portal  

1. Sign up in Okta portal using https://www.okta.com/developer/signup/.
   
   Figure:  Sign up
   
   
2. Click Get Started. Your login URL is displayed. Login to Okta using this URL. You will receive a confirmation mail. Set your password by clicking this link.
   
   
   Figure:  Okta URL
   
   
3. Specify your User Name and Password and click Sign In.
   
   Figure:  Okta Login page
   
   
4. On the top menu, select Security > API.
   
   Figure:  Security Menu
   
   
5. On the API page, click Authorization Servers.
   
   Figure:  API Page
   
   
6. On the Add Authorization Server pop-up page, Specify Name, Audience, and Description.
   For more information about these fields, refer https://developer.okta.com/authentication-guide/implementing-authentication/set-up-authz-server.html.
   
   Figure:  Add Authorization URL Pop-up page
   
   

7. Under the Settings section, the issuer field is displayed. Store this URL securely.
   
   Figure: Settings section
   
   

   Note

   The Issuer URL displayed here should be entered in the Authorization URL, Access Token URL, and User Info URL fields of SymphonyAI Summit application.

8. Select Access Policies and click Add Policy. The Add Policy pop-up page is displayed.

Figure:  Add Policies pop-up page

9. On the Add Policy pop-up page, specify the Name, and Description and click Create Policy.

Figure:  Add Policy page.

10. On the Add New Access Policy page, create Add Rule.

Figure:  Add New Access Policy Page

11. On the Add Rule pop-up page, specify the Rule Name and click Create Rule.

Figure:  Add Rule Pop-up page

12. On the top menu, hover your mouse over Applications and select Applications.

Figure:  Applications

13. On the Applications page, click Add Application and then click Create New App.

Figure:  Add Application

14. On the Create New Application pop-up page, select the platform as Web and Sign On Method as OpenID Connect.
Figure:  Create New App page

15. On the Create OpenID page, specify the Application Name and the Redirect URL.

Figure:  Create OpenID page

16. On the General Settings Page, click Edit and select all the available options under Allowed grant types. The Client ID and Client Secret are displayed under Client Credentials section. Store them securely.

Figure:  General Settings page

17. You can add multiple People or Groups to the application under the Assignments section.

Figure:  Add Assignment page

Configuring SSO for Okta OIDC

To Configure SSO for Okta OIDC from the SymphonyAI Summit application, perform the following steps:

1. Select Admin > Basic > Infrastructure > SSO Configuration. The SSO CONFIGURATION page is displayed.
2. On the SSO CONFIGURATION page, select OAuth under the Authentication Type and click ADD NEW on the ACTIONS Panel.
   
   
    Figure:  SSO Configuration: OIDC_Okta
   
   
3. Specify the required details and click SUBMIT. For more details about the fields on the SSO CONFIGURATION page, see Field Description.

Field Description 

The following table describes the fields on the SSO CONFIGURATION page:

For more information on SSO Configuration, see SSO Configuration: OAuth.
Note
Below items must be configured on customer end:

• OIDC Scope must be configured at the customer's OIDC provider end.
• Ensure that OIDC Scope configured is specified as: openid profile email with a space separator and all letters small.