Okta

This walkthrough creates a SAML 2.0 app integration in Okta and collects the three values the CyberGuard SSO form needs: the IdP Entity ID, the Metadata URL, and a matching SP Entity ID.

Before you start

Open Extra → Settings → SSO in CyberGuard in a second tab and note the SP Entity ID shown there — Okta calls the same thing the Audience URI. You also need your CyberGuard base URL, because the single sign-on URL is derived from it:

<base_url>/api/accounts/saml/0/acs/

For example, https://cyberguard.guardiangrid.ai/api/accounts/saml/0/acs/.

Create the app integration

1. Open your Okta admin console (it looks like https://<your-org>.okta.com/admin/dashboard).

2. In the sidebar menu, go to Applications → Applications.

3. Select Create App Integration.

4. Choose SAML 2.0 and select Next.

5. Give the app a name and select Next.

Configure SAML

1. Set Single sign-on URL to <base_url>/api/accounts/saml/0/acs/.

2. Set Audience URI (SP Entity ID) to exactly the SP Entity ID from the CyberGuard SSO form.

3. Set Application username to Email. CyberGuard matches accounts on the email address, so this has to be right.

4. Add the Attribute Statements that carry the user’s names:

   • http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname for the first name
   • http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname for the last name

5. Select Next, fill in the feedback page however you like, and select Finish.

Collect the values

1. On the application’s Sign On tab, open the SAML 2.0 settings box.

2. Copy the Metadata URL — this is the Metadata URL in CyberGuard.

3. Copy the Issuer — this is the IdP Entity ID in CyberGuard.

Grant access

1. Open the Assignments tab of the application.

2. Select Assign and choose whether to assign individual people or groups.

Note

Adding a user to the application in Okta does not create their CyberGuard account. Either create the user under Organization → Users first, or turn on auto-provisioning as described in the SSO overview.

Finish in CyberGuard

1. Go to Extra → Settings → SSO and tick Enable SSO.

2. Set Provider to SAML.

3. Paste the IdP Entity ID and the Metadata URL you copied from Okta.

4. Check that the SP Entity ID still matches the Audience URI you registered in Okta.

5. Save. The login page now shows a Login with SSO button.

Tip

If the CyberGuard instance cannot reach Okta over the network, leave the Metadata URL empty and use the second option instead: fill the SSO URL (login), the SLO URL (logout) and the x509 certificate from the Okta setup instructions.

Related

• SSO overview — the full field reference and the auto-provisioning options.
• Microsoft Entra ID — the equivalent walkthrough for Entra ID.
• Users — creating the accounts SSO will sign in.