Okta Admin SSO

This basic guide shows how to configure Okta for Admin SSO with uStudio Platform. Please note that this guide may not cover everything your organization may want to set up.

1. Login into Okta as an Admin.
2. Click Create App Integration under the Applications section.
3. Select SAML 2.0 as the application template.
4. Click Next to proceed.
5. Under General Settings, set App name to uStudio Admin SSO.
6. Select "Do not display application icon to user" because we use other URLs to login.
7. Select "Do not display application icon in the Okta Mobile app" because we use other URLs to login.
8. Click Next to proceed.
9. Under SAML Settings, set Single sign-on URL to https://login.ustudio.com/auth/realms/platform-users/broker/companycode/endpoint and make sure to replace companycode with your Company Code provided by uStudio.
10. Ensure "Use this for Recipient URL and Destination URL" is select.
11. Set Audience URI (SP Entity ID) to https://login.ustudio.com/auth/realms/platform-users/broker/companycode/endpoint and make sure to replace companycode with your Company Code provided by uStudio.
12. Ensure Default RelayState is blank.
13. Ensure Name ID format is set to Unspecified.
14. Ensure Application username is set to Okta username.
15. Ensure Update application username on is set to Create and update.
16. Scroll down to Attribute Statements.
17. Click Add Another 3 times.
18. On row 1, set Name to given_name and Value to user.firstName.
19. On row 2, set Name to family_name and Value to user.lastName.
20. On row 3, set Name to email and Value to user.email.
21. Scroll down to until you see the preview for the SAML Assertion section.
22. Click Next to proceed.
23. Under Feedback, select "I'm an Okta customer adding an internal app."
24. Select "This is an internal app that we have created."
25. Click Finish to proceed.
26. Metadata & Certificate Swapping. Now you should be in the Sign On tab where you can scroll down to the SAML 2.0 section. Please send your Metadata URL to uStudio and wait for uStudio to provide you a X509 Certificate back. 
27. After you have received our X509 Certificate, please go to the General tab and click Edit under the SAML Settings.
28. Click Next to proceed.
29. Scroll down until you see "Show Advanced Settings" and click it to expand the options.
30. Ensure Response is set to Signed.
31. Ensure Assertion Signature is set to Signed.
32. Ensure Signature Algorithm is set to RSA-SHA256.
33. Ensure Digest Algorithm is set to SHA256.
34. Ensure Assertion Encryption is set to Unencrypted.
35. Upload our X509 Certificate to Signature Certificate.
36. Ensure "Allow application to initiate Single Logout" is deselected.
37. Ensure "Validate SAML requests with signature certificates" is deselected.
38. Ensure "Other Requestable SSO URLs" is blank.
39. Ensure Assertion Inline Hook is set to None.
40. Ensure Authentication context class is set to PasswordProtectedTransport.
41. Ensure Honor Force Authentication is set to Yes.
42. Ensure SAML Issuer ID is set to http://www.okta.com/${org.externalKey}
43. Scroll down to the Preview the SAML Assertion section and click Next to proceed.
44. Click Finish to proceed.
45. Go to the Assignments tab and assign People or Groups to this application.
46. Now you may proceed to admin onboarding as documented here: https://ustudio.zendesk.com/hc/en-us/articles/360052700771-Platform-SSO-SAML-Connection-Process