Okta SSO Configuration

This basic guide shows how to configure Okta with uStudio Podcast. Please note that this guide may not cover everything your organization may want to set up.

PREREQUISITE

uStudio needs a sign-on URL and certificate. See Step 5 for details.

Step 1: Creating an Okta SSO Application

1. Login into Okta as an administrator.
2. Select Classic UI.
3. Go to Applications.
4. Click Add Application.
   
5. Click Create New App.
   
6. Select Platform as Web.
7. Select SAML 2.0.
8. Click Create.
   

Step 2: General Settings

1. Enter in an App name (e.g. uStudio SSO).
2. [Optional] Upload an App logo (e.g. uStudio_Logo.png).
3. Check “Do not display application icon to users.”
4. Check “DO not display application icon in the Okta Mobile app.”
   Note: You’ll need to create a service provider initiated icon tile for people to use. Route people to https://podcast-web.ustudio.com/ or https://podcast-web.ustudio.com/COMPANYCODE.
5. Click Next.
   

Step 3: Configure SAML

1. Set Single sign on URL as https://ustudioinc.auth0.com/login/callback?connection=prod-companycode-podcast-sso.
2. Set Audience URI (SP Entity ID) as urn:auth0:ustudioinc:prod-companycode-podcast-sso.
   Note: companycode is provided by uStudio.
3. Leave Default RelayState blank.
4. Set Name ID format as EmailAddress.
5. Set Application username as Okta username.
6. Click Show Advanced Settings.
7. Set Response as Signed.
8. Set Assertion Signature as Signed.
9. Set Signature Algorithm as RSA-SHA256.
10. Set Digest Algorithm as SHA256.
11. Set Assertion Encryption as Encrypted.
12. Set Encryption Algorithm as AES256-CBC.
13. Set Key Transport Algorithm as RSA-OAEP.
14. Upload our public certificate from https://ustudioinc.auth0.com/cer to Encryption Certificate.
15. Uncheck Enable Single Logout.
16. Set Authentication context class as PasswordProtectedTransport.
17. Set Honor Force Authentication as No.
18. Leave SAML Issuer ID as is.
19. [Optional] Add Attribute Statement given_name formatted as Basic with Value set as user.firstName.
20. [Optional] Add Attribute Statement family_name formatted as Basic with Value set as user.lastName.
21. [Optional] Add Attribute Statement email formatted as Basic with Value set as user.email.
    Note: given_name, family_name, and email are used for dashboard analytics.
22. [Optional] Add Group Attribute Statement groupName formatted as Basic with Filter set as Matches regex where .*.
    Note: This filter gets all groups associated with a user. You can specify which groups you really want to send over.
    
    
23. Click Next.
     

Step 4: Feedback

Fill out this form accordingly. Then click Next.

Step 5: Sign On

Prerequisite

Select Sign On and click Identity Provider metadata and save it as a file. Then send this metadata to your uStudio Support Agent or email it to [e-mail]. This metadata contains your sign-on url and X.509 Certificate.

Step 6: Assigning Users and Groups

1. Select Assignments.
2. Select People or Groups.
3. Click Assign and select Assign to People or Assign to Groups.
   
4. Click Assign on each person or group you wish to assign uStudio.
5. Click Done.
   

Step 7: Test with uStudio

Login into uStudio Enterprise Podcast on mobile and web. Tell your uStudio Support Agent or [e-mail] to verify the SSO connection.