Single Sign On (SSO) - Okta Configuration

Prerequisites

• An Okta account is needed before EngageIP can be configured for Single Sign On.  You can create your account by visiting Identity | Okta

• You will need two SSL certificates. One for the SAML request signing, this can either be a self signed certificate or from a public CA (e.g. GoDaddy). The other will come from Okta (see step 13 below)

• To configure the Single Sign On option in EngageIP, the logged in user needs to be a member of a role that has the "OwnerSingleSignOnConfiguration" options enabled. To check this go to Setup / Roles / select the proper role / find the "OwnerSingleSignOnConfiguration" under "ROLE PERMISSIONS"

Adding EngageIP to Okta

1. Login to your Okta Dashboard

2. Click on the Applications tab in the top menu bar

   Open

   

    

3. Click the Add Application button

   Open

   

    

4. Click the Create New App button

   
   
   

5. Set the Platform to 'Web', and the Sign on method to 'SAML 2.0' and click Create

    

6. Populate an App name (e.g. 'EngageIP') for this configuration and then click Next

    

7. Configure the SAML properties with the proper IP/DNS entry in the Single sign on URL

    

8. Scroll down and click Next

9. Select the option: I’m an Okta customer adding an internal app and click Finish

10. On the EngageIP application page, click View Setup Instructions

     

11. You will be presented with information for configuring the service provider (EngageIP). Copy the data shown in 'Identity Provider Single Sign-On URL' and 'Identity Provider Issuer', and then download the certificate by clicking the Download Certificate button for use a bit later

Configuring Okta in EngageIP

1. Log into the web server that is running your EngageIP instance

2. Browse to the C:\Program Files (x86)\EngageIP\AdminPortal folder

3. Create a folder called 'Certificates' and place your SAML signing certificate and the certificate you downloaded in step 13 above into the new folder

4. Go back into the 'AdminPortal' folder and find the web.config file. Backup the config file

5. Open the original web.config file in a text editor

6. Add the below line in the <configSections> area

   <section name="samlConfiguration" type="Logisense.Boss.Presentation.SamlConfigurationSection" />

7. Add the line below to the bottom of the web.config just above the </configuration> line
   Note: this step is using your SAML Signing Certificate, not the one you downloaded from Okta

   <samlConfiguration name="EngageIP" description="Engage Default" assertionConsumerServiceUrl="~/login/saml.rails" localCertificatePassword="YOUR_SAML_CERT_PSWD" localCertificatePfxFile="Certificates\YOUR_SAML_CERT.pfx" />

   Important: You must save the changes you made to the web.config file. Saving the changes will cause the application pool to recycle which will terminate any active sessions and will require your users to log back into the EngageIP system ***

8. Login as an administrator into EngageIP

9. Click on Setup then scroll down to Accounts and Roles. In the Permissions area you will see the option for Single Sign On, click it to go to the SSO setup page

    

10. Configure the SSO Settings:

Adding Users to Okta

1. Access your Okta admin dashboard

2. Click People in the Directory menu

    

3. Click Add Person

4. Fill out the applicable fields in the Add Person form and click Save

Assigning Okta Users to EngageIP

1. Access your Okta admin dashboard

2. Click People in the Directory menu

3. Click on the user you wish to assign EngageIP to

4. Click the green Assign Applications button

    

5. Click Assign for the EngageIP application that you setup

    

6. Confirm the username you want to use and then click the Save and Go Back button

7. Click Done

Configuring User Mapping in EngageIP

1. Login to EngageIP

2. Navigate to the Overview page for the owner you wish to configure SSO for using Okta

3. Click Add under the Components and then click on Single Sign On

   
   Note: if the Single Sign On link does not appear, ensure that you've properly configured Single Sign On for this owner.  See Configuring Okta in EngageIP steps above)

4. Configure the SSO component

5. Enter the 'SAML Federation ID'. This is the user name that you configured when 'Assigning Okta users to EngageIP' in the configuration steps above

6. Ensure that the Single Sign On Enable checkbox is checked

7. Click Save

Logging Into EngageIP From Okta

1. Navigate to your user home for the user you wish to log into EngageIP as.  This is likely the same as the Logout URL that you configured for the EngageIP owner's Logout URL (e.g. oktapreview.com/app/UserHome)

2. Log into Okta and you should see your EngageIP application available.  If not, then please see the 'Adding EngageIP to Okta' and/or 'Assigning Okta Users to EngageIP' configuration steps above

3. Click on the EngageIP button

4. You should now see the login process log you into EngageIP

See Also

• Single Sign On (SSO) – Overview

• Single Sign On (SSO) – Auth0 Configuration