Configuring SAML Okta

Getting Started with Okta for SAML

An Okta administrator can create new apps to set up the integration:

1. Log into your Okta instance using an administrative account.

2. Go to the App Home page ([Instance Name]/app/UserHome), and click Admin.

   

3. From the left menu, click Applications > Applications:

   

4. Select Create App Integration:

   

5. In the Create a New Application pop-up window, select SAML 2.0, and click Next:

   

6. In the General Settings tab, type the preferred name (for example, SecretServer) in the App name field, and click Next. The App name field is the only required input on this screen.

   

Okta Configuration

1. Log into Okta, go to the My Apps page, and click Admin:

   

2. Go to the Okta application, select Applications and then the Applications sub-topic:

   

3. Under the General tab, click Edit:

   

4. Once the Edit SAML Integration page appears select Next to proceed:

   .

5. Once the Configure SAML tab loads, click Show Advanced Settings at the bottom of the screen:

   

6. The Signature Certificate page appears and the public key .cer file that corresponds to the .pfx is uploaded to your Secret Server Service Provider (see Setting Up Secret Server for details on configuring SAML SSO and uploading Certificates).

7. Click Browse files… and select your certificate’s .cer file:

   

8. Once completed, the .cer file will display under the Signature certificate field:

   

9. Select the Enable Single Logout checkbox below the Signature Certificate field, as shown above.

10. Configure the Single Logout (SLO) Settings as follows:

    • Single Logout URL: your [SecretServerInstanceName] followed by the URL string: /saml/sloservice.aspx.

      Example: https://[YourSecretServerInstance.com]/saml/sloservice.aspx

    • SP Issuer: SecretServerServiceProvider

      The Certificate File Name should change if the upload is successful. If the upload is unsuccessful, ensure you are using either Firefox or MS Edge browser, not Chrome.

11. Click Next and Finish.

Configuring Okta for SAML

To configure Okta for SAML to integrate with Secret Server, follow the steps below.

1. Set up Secret Server as a new application in Okta.

2. Add Okta details to the Secret Server SAML settings by configuring as follows:

   • Set up Single Logout
   • Add Users

3. Verify that the integration works.

Configuring SAML in the Okta Application

Secret Serverneeds to be set up as a new application in Okta.

1. On the Configure SAML tab, type the required information according to your organizational environment. See the following for what required descriptions and examples will entail:

   • Type the Single sign on URL for your secret-server instance: https://[YourSecretServerInstance.com]/saml/assertionconsumerservice.aspx

   • Make sure the Use this for Recipient URL and Destination URL is selected.

   • Deselect Allow this app to request other SSO URLs if Okta is the only IdP.

2. In the Audience URI (SP Entity ID) field, do the following:

   • Type the Service Provider configured in secret-server (for example: SecretServerServiceProvider)
   • Leave the Default RelayState field blank.
   • For the Name ID format field, select Unspecified from the dropdown list.
   • For the Application username field, select Okta username

3. Click Next.

4. On the Feedback window, select I’m an Okta customer adding an internal app.

Downloading the IDP Metadata File

1. Go to Applications and click on the required SAML app.

2. Select the Sign On tab.

3. The URL for the metadata is located on the Sign On tab. To access the active certificate, go to the SAML Signing Certificates section and look for the type marked with the Active status. Select the Actions dropdown menu and click View IdP Metadata:

   

4. After the Metadata page loads right-click on the page and select Save As or Save Page As (depending on the browser). By default, in Edge you will select Save As, and the file will download as an XML file. In Firefox, alternatively, click Save Page As and select the All files option.