Configure Okta SAML for SSO

You can make an Okta custom SAML application the identity provider (IdP) of your Azion account, so users sign in to Azion Console with their Okta corporate identity and no separate Azion password. The work alternates between the Okta Admin Console and Azion Console. For the Azion side alone, or for an Open ID provider, refer to Configure an identity provider for SSO.

Prerequisites

• Administrator access to the Okta Admin Console.
• Access to Azion Console as an Account owner. To sign in, refer to Access Azion Console.
• Every user of the account registered in Azion. The IdP and Azion hold the same users, and a user that does not exist in Azion cannot sign in. To add users, refer to Manage users.
• A text editor to hold the Okta values until you enter them in Azion Console.

Create the SAML app in Okta

Okta requires a single sign-on URL and an audience URI before it saves the app. Use https://sso.azion.com for both now, and replace them with the Azion values later.

To create the app integration in the Okta Admin Console:

1. Sign in to the Okta Admin Console.
2. On the homepage, under Applications, select Applications.
3. Select Create App Integration.
4. In the modal, select SAML 2.0 and then Next.
5. Enter a name for the app. For example: Azion SAML.
6. Select Next.
7. In the General section, enter https://sso.azion.com in Single sign-on URL.
8. Enter the same URL in Audience URI (SP Entity ID).
9. In the Attribute Statements section, set Name to email, Name format to Basic, and Value to user.email.
10. Select Next.
11. Fill in the Feedback section as required, and select Finish. The app details open.
12. Select the Sign On tab.
13. Under Metadata details, select More details.
14. Copy the Sign on URL to your text editor. Its format is https://account-name.okta.com/app/app-id/sso/saml.
15. Copy the Issuer to your text editor. Its format is http://www.okta.com/app-id.
16. In the SAML Signing Certificates section, find the active certificate, or generate a new one.
17. For the certificate to use with Azion, select Actions > View IdP metadata.
18. Copy the value inside the <ds:X509Certificate> XML tag to your text editor.

Your text editor now holds the sign on URL, the issuer, and the certificate for the Azion form.

Create the identity provider in Azion Console

The Create Identity Provider form takes the Okta values. Azion then generates the values that Okta needs back.

To create the identity provider:

The identity provider appears in the Identity Providers list. Do not set it as active until the Okta app carries the Azion values.

Complete the SAML app in Okta

The Azion values replace the temporary https://sso.azion.com entries.

To finish the app in the Okta Admin Console:

1. In the Okta Admin Console, open the app for Azion and select the General tab.
2. In the SAML Settings section, select Edit.
3. Select Next.
4. In Single sign-on URL, paste the Assertion Consumer Service URL.
5. In Audience URI (SP Entity ID), paste the Service Provider’s Entity ID URI.
6. Select Next.
7. Select Finish.

The Okta app points at Azion.

Assign users in Okta

Each assigned user signs in with the email configured in Okta. That email must match the email of the user in Azion.

To assign users to the app in the Okta Admin Console:

1. In the Okta Admin Console, open the app for Azion and select the Assignments tab.
2. In the Assign dropdown, select Assign to People.
3. In the list, select Assign next to each user to add.
4. Select Save and Go Back.
5. Repeat the steps for every user who signs in to Azion through Okta.

The assigned users can reach the app.

Set the identity provider as active

To activate the identity provider:

Every user of the account, except the Account owner, signs in to Azion Console through Okta. While Okta is the IdP, Okta verifies multi-factor authentication (MFA) instead of Azion. When the account goes back to the Azion login, each user keeps the MFA status that was last active.

Next steps