How to setup Yotascale SSO with Okta using the SAML Auth provider

Currently Yotascale provides support for Google Auth, SAML or Okta OpenID authentication, with a limitation of only 1 Authentication Provider at any given point in time. This guide focuses on setting up Okta as your IdP using Yotascale's SAML authentication provider.

Yotascale - Retrieve SAML Auth data:

1. Login to Yotascale with a user account that has Admin Role access
2. In top right hand corner select the round circle with the users initials
3. Select Manager Users
4. Select Manage Auth Provider tab
5. Select "+ New Auth"
6. From Auth Provider drop down select SAML
7. Enter an Organization name
   1. This is required in order to create the URLs.
8. At bottom of page copy and save the Redirect/ACS URL:  
   1. Example: https://rest-api.demo-prod.yotascale.io/login/organization/sandbox/auth/saml/authorized
9. Keep the page open

Okta - Create Application

1. Login to Okta
2. Select Applications
3. Click on the button "Create App Integration"

• Select "Next"
• Enter App name

1. Example: "Yotascale"

• Add App logo if required
• Select Next
• SAML Settings
  1. Enter the saved data of Redirect/ACS URL from Yotascale
  1. Enter the https://domainname.com from saved data of Redirect/ACS URL from Yotascale

1. For Single Sign on URL:
2. For Audience URI (SP Entity ID) :

• Select "EmailAddress" as Name ID format
• Select "Email" as Application username
• Add these three attribute statements in the attribute section with Name Format "Unspecified":

1. "email" set to "user.email"
2. "first_name" set to "user.firstName" (optional)
3. "last_name" set to "user.lastName" (optional)

1. Under Feedback, for "Are you a customer or partner" select "I'm an Okta customer adding an internal app"
2. Select Finish
3. Under Sign On tab for the new application

1. 

2. Select "View Setup Instructions"
3. Copy and save the Identity Provider Single Sign-On URL
4. Copy and Download the X.509 Certificate

• Assign users/groups to the application

Yotascale - Complete SAML Auth Provider configuration

1. You should still be logged in and on the SAML Auth Provider configuration page

1. If not, login again to Yotascale with a user account that has Admin role access
2. Follow the same steps to add a new SAML Auth provider as described above.
   1. Make sure to add the same Organization name for SAML

• Enter the following information:
  1. As an example enter {{organization name}}.com
  1. Enter the Identity Provider Single Sign-On URL from Okta Application recorded earlier
  1. Paste the X.509 Certificate from Okta Application recorder earlier
  1. Enabled - When user authenticates through Okta, the user account will automatically be created in Yotascale User list.
  2. Disabled - User accounts first needs to be manually created in Yotascale.
  1. Admin/Power User/Tag Admin/User

1. Organization name already entered
2. Entity ID
3. SSO URL
4. IDP Certificate
5. Auto Provisioning
6. Default Provision Role

• Select Create New Auth

• 

• In order to verify the Auth provider, a user account needs to be created manually in Yotascale that matches the user that has permissions to the Yotascale application in Okta.
  1. Admin/Power User/Tag Admin/User

1. Under Manage Users tab, select User List
2. Select "+ New User"
3. Enter the First Name
4. Enter the Last Name
5. Enter the email address that matches the email address of the user that has access to the Okta applications.
6. Select Applicable role based on your requirements
7. Select "Yotascale" from dropdown for Auth.
8. Select "Create User"

• Under Manage Users tab, select the Manage Auth Provider tab

1. For the SAML Auth Provider select "Verify auth Provider"
2. This will open the Okta login page
3. Login with same user account that has access to the Okta Application and was created manually in Yotascale.
4. The successful login should verify the Auth Provider.

• Under Manage Users tab, select User List

1. For the manually created user, select the Auth dropdown and change value from Yotascale to the SAML Auth provider name.
2. Select "Save Changes"

• Configuration is now complete and users should be able to login via Okta successfully.
• If you run into any issues, please contact our support team.

Related articles