Tutorial: How to Configure SAML with Okta⁠

You need the following to get started:

• An Okta account.

• A deployed Access Server.

With Okta, you must create a custom SAML application.

First, gather information about your Access Server as the service provider (SP).

1. Sign in to your Access Server Admin Web UI.

2. Select Authentication → SAML.

3. You'll need the following information:

   1. SP Identity.

   2. SP ACS.

Now that you have your SP information, you can create a new Okta SAML app and enter that information during app creation:

1. Sign in to your Okta admin dashboard.

2. From Applications, create a new app integration.

3. Select SAML 2.0 and click Next.

4. Provide an App name and App logo, choose the App visibility, then click Next.

5. Use the SP information from Access Server to enter the following into the Okta:

   1. Single sign on URL: Enter the Access Server SP ACS.

   2. Audience URI (SP Entity ID): Enter the Access Server SP Identity.

   3. Default RelayState: Enter ‘cws’ for the Client Web UI or ‘profile’ to provide users with a downloadable profile. (See "How to set up IdP-initiated flow" below for more details.)

6. Click Next.

The simplest way to set up Okta SAML for Access Server is to provide the metadata XML file (option 1), but you can also manually configure it (option 2).

You can now enable SAML as the global default authentication or for specific groups and users.

You must assign this app to users or groups in Okta:

1. Sign in to the Okta admin dashboard.

2. Select your SAML app and click the Assignments tab.

3. Assign the SAML app to users or groups, or you can assign it to everyone:

   1. Click Assign > Assign to Groups.

   2. Click Assign for Everyone and click Done.

All users in your organization should now have access to your Access Server SAML app.

You can configure an IdP-initiated flow for signing into Access Server from Okta with the following steps:

1. Sign in to the Okta admin dashboard.

2. Click Applications > Applications, and click your custom SAML app.

3. Click General and edit for SAML settings.

4. Under 2 Configure SAML, enter one of the following for Default RelayState:

   1. cws: This directs your users to the Client Web UI after sign-in.

   2. profile: This directs your users to a profile download after sign-in.

5. Save changes.

Your users can now sign in to Okta and find the Access Server SAML application under My Apps.

You can automate group assignments for access control rules using a post-authentication Python script.

Refer to the steps in this tutorial:

• Tutorial: How to Set Up SAML Group Mapping with a Post-Auth Script