Okta SSO configuration guide

• Creating Okta SSO application
• Metadata information
• Creating Okta Bookmark application (optional)
• Assign users
• Add application logo (optional)
• Certificate renewals

Creating Okta SSO application

1. In Okta, navigate to “Applications > Applications” and press on “Create App Integration”
   

2. In the modal, please select “SAML 2.0” and click on “Next”

   

    

3. Fill in an “App name” and press on “Next”. You are free to check any of the “App visibility” options if they apply to you. Also, you do not need to add anything for the App logo as this application will not be used to be presented to your users (more on this in the “Creating Okta Bookmark application” section)

Metadata information

The easiest way to retrieve the information necessary for the SAML 2.0 connection is through the metadata file. This can be acquired in two ways:

• Through your Spacewell contact which has provided you with the URL. If so, you can skip to uploading the metadata file
• By collecting it yourself. To do this, you need to retrieve the server instance of your Asset system. View the section below for this ​

  https://onespacewell.atlassian.net/wiki/spaces/~62e256719974783acc356c63/pages/4338384996Can't find linkOpenOpen, (opens new window).

1. Once you have the URL, you can open this in your browser. If so inclined, you can also download the file and open it in your favorite text editor.
2. In the below table, you can find the mapping with in the first column the field in the Okta application and in the second column the tag name in the XML from the Asset Federation Metadata.

3. Scroll down to the “Attribute Statements (optional)” and add the attributes that should be shared. As a minimal, you should add “user.email”, “user.firstName” and “user.lastName”. Take note of the values in the column “Name”, as those need to be shared with your Spacewell contact. Use the “Add Another” button to add additional attributes if you need those.

4. Press on “Next”

5. In the next screen, set the value to “I’m an Okta customer adding an internal app” and “This is an internal app that we have created”.

6. Click “Finish”

7. In the resulting screen, navigate to the section “SAML Signing Certificates”.
8. Click on the active certificate and press “Actions”, followed with “View IdP metadata”.
9. A tab should open with the necessary Metadata URL. Make note of the URL and share this with your Spacewell contact.

Creating Okta Bookmark application (optional)

If you would like users to login from Okta into Asset, you will need to make a bookmark application. The SSO application in Okta does not allow a URL to be specified with which a user can login. Adding a bookmark application does make this possible.

In Okta, click on “Applications > Applications” followed by “Browse App Catalog”

1. Search for “Bookmark” in the search bar and select the “Bookmark App”
   

2. Click on “Add Integration”

   

3. Fill in an “Application Label” and the “URL”. In most cases, the URL value should be the following: https://client.axxerion.com/axxerion/sso
   Where you replace “client” with your client specific URL that you should already be familiar with. Be aware that Asset supports multiple SSO connections within one client environment. If that is the case, this URL will be different and should be discussed with your Spacewell contact.

4. Press on “Done” when you are ready

Assign users

Assigning users applies to at least the SSO application and optionally the bookmark application.

1. Open the application and go to the “Assignments” tab. Click on “Assign” and select if you would like to add People or Groups
   

2. In the below example, we will add one specific user. Select the users that you would like to add and press “Assign”. Once assigned, press “Done”

   

3. Your users should be visible in the application

Add application logo (optional)

1. If you would like to add a logo to either application, you can download the Asset logo below.
2. Click on the logo and the image should be enlarged.
3. You can download it by pressing the “Download” icon on the top right.
   

4. Open the application and press on the “pen” icon near the existing logo (most likely the cog)

   

    

5. Then select the downloaded image and press on “Update Logo”

Certificate renewals

• Every year, Asset will update the certificate that is used for the SSO connection. Currently, Okta will accept this certificate without any necessary steps from your end being necessary.
• In case the certificate is renewed on the Okta end, Spacewell should be notified of this as soon as possible through the necessary support channels. Having provided Spacewell with the Federation Metadata URL will allow a Spacewell contact to easily update the necessary settings on the Asset end. Should Spacewell not be notified, the SSO connection will cease to function once the certificate on the end of Okta expires.