At the top right of the Unqork Designer Platform, click Administration.
2.
Under Environment, select Single Sign-On (SSO).
3.
Click + New SSO.
4.
From the + New SSO drop-down, select Express or Designer.
5.
In the SSO Name field, enter a unique name for your configuration.
This name is used to generate the default SP Entity ID.
6.
In the Default Role drop-down, select a role.
When setting up SSO for Express View, select a default role with the lowest-level permissions. This lets you rely on the value stored in Okta to determine higher-level permissions.
7.
(Optional) In the Default Groups list, select one or more groups.
8.
Click Next. The Configure Protocol tab displays.
9.
Set Select Protocol* to SAML.
10.
In a text editor, open the IdP metadata XML file provided by the SSO service.
11.
In the IdP Metadata XML* field, copy and paste the contents of the file.
The SAML IdP NameID Format field is optional. The default value for this field is urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress. The NameID is a unique identifier that matches an end-user across multiple Unqork sessions.
12.
(Optional) In the SAML SP Entity ID field, enter a value.
This value must match the value used by the IdP. If you're asked to define the Entity ID, use a value that relates to your configuration. For example, {environment name and codebase}-{application name}-saml. The Okta administrator might also have their own preferred Entity ID naming conventions.
13.
(Optional) You can leave the default value for the SAML Callback URL field unless the Okta app integration uses a different value.
14.
Click the Show Advanced Settings button.
15.
(Optional) Set Use Signed AuthnRequest to (checked).
16.
(Optional) Set Expect Encrypted Assertions to (checked). The SAML Certificate* drop-down displays.
Creators can either enable Use Signed AuthnRequest, Expect Encrypted Assertions, or enable both settings depending on their configuration setup.
17.
From the SAML Certificate* drop-down, select the certificate created during the Create a SAML Certificate steps.
18.
Click Next. The Attribute Mapping tab displays.
19.
Enter the attribute mapping information for the SSO.
After completing the Unqork side of the setup, test your configuration.
You'll need a set of test credentials from the Okta administrator. The test user must be assigned to the app integration in Okta, under the Assignments tab.
Testing an SP-Initiated Flow
From the SSO dashboard, you can preview the Unqork entrypoint and use a set of test credentials from your SSO provider to test the configuration. To test the SP-initiated flow:
1.
In the SSO dashboard, find the SSO configuration to preview.
2.
Click Manage. A drop-down menu displays.
3.
From the Manage drop-down, right-click Preview.
4.
Click Open Link in Incognito Window.
By default, the Unqork entrypoint URL uses 123 as the module ID. To test access to an actual module in your application, replace 123 at the end of the URL with your module's module ID.
5.
Log in using your test credentials.
If you see an error page, there are issues with your configuration. If you can successfully log in to Unqork, your SAML configuration of Okta as SSO provider is working.
Testing an IdP-Initiated Flow
To test the IdP-initiated login flow, you'll need the Embed Link found in Okta.
1.
In Okta, navigate to the Applications page.
2.
Select your app integration.
3.
In the Embed Link field, copy the value.
4.
Open a new Incognito window of your browser.
5.
Paste the Embed Link into the browser.
6.
Log in using your test credentials.
If you see an error page, there are issues with your configuration. If you can successfully log in to Unqork, your SAML configuration of Okta as SSO provider is complete.
It's useful to view what assertions your application receives from Okta. Assertions are not logged in Service Logs. Instead, you can use Google Chrome extensions, like SAML Chrome Panel or SAML Message Decoder. Comparing the assertions you receive against the assertions you expect can help with debugging.
SAML.
