mirror of
https://github.com/andwati/zitadel.git
synced 2026-11-12 09:05:12 +00:00
802b6c7fd1
* docs: add guide to setup okta saml idp * docs: remove todo * docs: okta user data info * docs: fix broken links * docs: add references to API docs * Update docs/docs/guides/integrate/identity-providers/okta_saml.mdx Co-authored-by: Silvan <[email protected]> * Update docs/docs/guides/integrate/identity-providers/okta_saml.mdx Co-authored-by: Silvan <[email protected]> * Update docs/docs/guides/integrate/identity-providers/okta_saml.mdx Co-authored-by: Silvan <[email protected]> * Update docs/docs/guides/integrate/identity-providers/okta_saml.mdx Co-authored-by: Silvan <[email protected]> * Update docs/docs/guides/integrate/identity-providers/okta_saml.mdx Co-authored-by: Silvan <[email protected]> * Update docs/docs/guides/integrate/identity-providers/okta_saml.mdx Co-authored-by: Silvan <[email protected]> * docs: default settings * docs: default settings * docs: add saml mapping action * docs: add saml mapping action * docs: add saml mapping action --------- Co-authored-by: Silvan <[email protected]>
122 lines
4.5 KiB
Plaintext
122 lines
4.5 KiB
Plaintext
---
|
|
title: Configure OKTA as a SAML Identity Provider in ZITADEL
|
|
sidebar_label: OKTA SAML SP
|
|
id: okta-saml
|
|
---
|
|
|
|
import GeneralConfigDescription from './_general_config_description.mdx';
|
|
import Intro from './_intro.mdx';
|
|
import CustomLoginPolicy from './_custom_login_policy.mdx';
|
|
import IDPsOverview from './_idps_overview.mdx';
|
|
import Activate from './_activate.mdx';
|
|
import PrefillAction from './_prefill_action.mdx';
|
|
import TestSetup from './_test_setup.mdx';
|
|
|
|
<Intro provider="OKTA"/>
|
|
|
|
## ZITADEL Configuration
|
|
|
|
### Add custom login policy
|
|
|
|
<CustomLoginPolicy/>
|
|
|
|
### Go to the IdP Providers Overview
|
|
|
|
<IDPsOverview templates="SAML SP"/>
|
|
|
|
### Create a new SAML Service Provider (SP)
|
|
|
|
To be able to create the application in OKTA we need the provider id from ZITADEL.
|
|
1. Create a new SAML SP with a name and a random text in the Metadata Xml field.
|
|
We will fill that as soon as we have done the configuration in OKTA.
|
|
2. Save Configuration
|
|
3. Open up the detail of the configuration and copy the provider ID from the browser URL:
|
|
`$CUSTOM-DOMAIN/ui/console/org/provider/saml/$PROVIDER-ID`
|
|
|
|
As an alternative you can add the SAML identity provider through the API, either on the default settings or on a specific organization:
|
|
- [Add Default SAML Identity Provider](/docs/apis/resources/admin/admin-service-add-saml-provider)
|
|
- [Add SAML Identity Provider on Organization](/docs/apis/resources/mgmt/management-service-add-saml-provider)
|
|
|
|
|
|
|
|
## OKTA Configuration
|
|
|
|
### Register a new client
|
|
|
|
1. Log in to your OKTA Account and go to the applications list: <OKTA-DOMAIN/admin/apps/active>
|
|
2. Click on "Create App Integration" and choose "SAML 2.0"
|
|
3. Give the application a name
|
|
4. Fill the configuration as following (Replace `your-domain` and `saml-idp-id` with your data):
|
|
- Single sign-on URL `{your-domain}/ui/login/login/externalidp/saml/acs`
|
|
- Audience URI (SP Entity ID): `{your-domain}/idps/{saml-idp-id}/saml/metadata`
|
|
- Example redirect url for the domain `https://acme.zitadel.cloud` would look like this: `https://acme.zitadel.cloud/idps/257372385775925924/saml/metadata`
|
|
5. Save the configuration
|
|
6. Copy the metadata URL from the details
|
|
|
|
|
|
|
|
### Add Attribute Statements
|
|
|
|
To send the user data from OKTA to ZITADEL you have to add some attribute mappings in your SAML Settings
|
|
You can define the name by yourself, just ensure you use the same later on in the ZITADEL Action we will add.
|
|
|
|
Add the following three mappings:
|
|
|
|
| Name | Name format | Value |
|
|
| ------------ | ----------- |--------------- |
|
|
| givenname | Basic | user.firstName |
|
|
| surname | Basic | user.lastName |
|
|
| emailaddress | Basic | user.email |
|
|
|
|
|
|
|
|
### Assign Users to Application
|
|
|
|
To allow users to authenticate with that app go to the "Assign" Tab.
|
|
1. Click the Assign Button
|
|
2. Choose Assign To People
|
|
3. Select the users you like to be able to authenticate
|
|
|
|
|
|
|
|
## Finish ZITADEL Configuration
|
|
|
|
You are now finished with the configuration in OKTA and you can switch back to your identity provider configuration in ZITADEL.
|
|
|
|
### Add Metadata Xml
|
|
|
|
Add the metadata URL you have saved before from OKTA to the Metadata URL.
|
|
As soon as you have saved the provider, and you have a look at the detail you should now see the Metadata Xml field filled.
|
|
|
|
If you prefer changing the configuration through the API you can update the SAML provider on the default settings or a specific organization:
|
|
- [Update Default SAML Identity Provider](/docs/apis/resources/admin/admin-service-update-saml-provider)
|
|
- [Update SAML Identity Provider on Organization](/docs/apis/resources/mgmt/management-service-update-saml-provider)
|
|
|
|
|
|
|
|
You can also fill the optional fields if needed:
|
|
|
|
<GeneralConfigDescription provider_account="OKTA account" />
|
|
|
|
### Activate IdP
|
|
|
|
<Activate/>
|
|
|
|
|
|
|
|
### Add Action to map user attributes
|
|
|
|
<PrefillAction fields="username, firstname, lastname, email and email verified" provider="OKTA"/>
|
|
|
|
```js reference
|
|
https://github.com/zitadel/actions/blob/main/examples/okta_saml_prefil_register_form.js
|
|
```
|
|
|
|
## Test the setup
|
|
|
|
<TestSetup loginscreen="your OKTA login"/>
|
|
|
|
|
|
|
|
|