Skip to content

Okta Single Sign-On Example

Okta is an identity and access management solution provider.

Steps

1. Create the Okta Application

Note: Before creating an application, you need to first register an account and create your organization on the Okta website.

  1. Open the Okta website and log in. Click the user in the top-right corner and select Your Org from the drop-down list.

  1. On the Okta organization page, click Application in the right-side menu, and on the page that opens, click Create App Integration.

  1. Select SAML 2.0 to create a new application.

2. Configure SAML for the Okta Application

Note: This step maps the Okta application attributes to Guance attributes, establishing a trust relationship between Okta and Guance so that they trust each other.

  1. In the General Settings of the newly created application, enter an application name, such as "okta", and click Next.

  1. In the SAML Settings section of Configure SAML, fill in the assertion URL and Entity ID.

  2. Single sign on URL: The assertion URL. For example: https://auth.guance.com/saml/assertion.

  3. Audience URI (SP Entity ID): The Entity ID. For example: https://auth.guance.com/saml/metadata.xml.

Note: This configuration is only used to obtain the metadata document in the next step. After enabling SSO in Guance, you need to replace these values with the correct Entity ID and assertion URL.

  1. In the Attribute Statements (optional) section of Configure SAML, fill in the Name and Value.

  2. Name: In this example, enter Email, which is used to pass the user's email address.

  3. Value: Fill in according to the actual email format of the identity provider. For Okta, you can use user.email.

Note: In the SAML attribute mapping of Guance, fill in the Email mapping with the attribute name returned here (in this example, Email). Also configure the required Username mapping. The Phone number mapping can be filled in as needed.

  1. In Feedback, select the following options and click Finish to complete the SAML configuration.

3. Obtain the Okta Metadata Document

Note: This step allows you to obtain the metadata document for creating the identity provider in Guance.

  1. In Sign On, click Identity Provider metadata to view the identity provider metadata.

  1. Right-click on the viewing page and save it locally.

Note: The metadata document is an XML file, such as "metadata.xml".

4. Enable SSO in Guance

  1. To enable SSO, go to Management > Member Management > SSO Management in the Guance workspace and click Enable.

For more information, see the document Create SSO.

Note: For account security reasons, Guance supports only one SSO configuration per workspace. If you have configured SAML 2.0 previously, the most recently updated SAML 2.0 configuration will be used as the final SSO verification entry point.

  1. Upload the metadata document downloaded in Step 3, configure the domain (the domain suffix of the email address), and select the role. You can then obtain the identity provider's Entity ID and assertion URL, and you can directly copy the login URL to log in.

Note: The domain is used by Guance and the identity provider to map email domains for SSO. That is, the domain suffix of the user's email address must match the domain added in Guance.

5. Replace the SAML Assertion URL in Okta

  1. Return to Okta and update the Entity ID and assertion URL from Step 2.

Note: When configuring SSO in Guance, the assertion URL configured in the identity provider's SAML must be consistent with the one in Guance for SSO to work.

6. Configure Okta Users

Note: This step configures the authorized user email accounts for the identity provider created in Guance. Users with the configured Okta email accounts can log in to the Guance platform via SSO.

  1. In Assignments > Assign, select Assign to People.

  1. Select the user who needs to log in to Guance via SSO, such as "jd@qq.com", and click Assign.

  1. Click Save and Go Back to complete the user configuration.

  1. Return to Assignments to view the authorized Okta users.

7. Log In to Guance with an Okta Account via SSO

  1. After the SSO configuration is complete, log in through the Guance official website or the Guance console, and select Single Sign-On on the login page.

  1. Enter the email address used when creating the SSO and click Get Login URL.

  1. Click the link to open the enterprise account login page.

  1. Enter the enterprise email address and password.

  1. Log in to the corresponding Guance workspace.

Note: If multiple workspaces are configured with the same identity provider SSO, after logging in to a workspace via SSO, users can click the workspace option in the top-left corner of Guance to switch between different workspaces and view data.

Feedback

Is this page helpful?