Skip to content

Okta SSO Example

Okta is a provider of identity and access management solutions.

Steps

1. Create an Okta Application

Note: Before creating the application, you need to register an account on the Okta website and create your organization.

1) Open the Okta website and log in. Click the user icon in the top right corner, and select Your Org from the dropdown list.

2) On the Okta organization page, click Application in the right menu, then click Create App Integration on the page that opens.

3) Select SAML 2.0 to create a new application.

2. Configure SAML for the Okta Application

Note: This step maps Okta application attributes to the attributes of TrueWatch, establishing a trust relationship between Okta and TrueWatch.

1) In the General Settings of the newly created application, enter an application name, such as "okta", and click Next.

2) In the SAML Settings section of Configure SAML, fill in the Assertion Consumer Service URL and Entity ID.

Note: This configuration is only for obtaining the metadata document in the next step. You need to enable SSO in TrueWatch, obtain the correct Entity ID and Assertion Consumer Service URL, and then replace them here.

3) In the Attribute Statements (optional) section of Configure SAML, fill in the Name and Value.

  • Name: The field defined by TrueWatch. Fill in Email to associate the identity provider's user email (the identity provider maps the logged-in user's email to Email).
  • Value: Fill in according to the actual email format of the identity provider. For Okta, you can enter user.email.

Note: This section is required. If left blank, SSO login will fail.

4) In Feedback, select the following options and click Finish to complete the SAML configuration.

3. Obtain the Okta Metadata Document

Note: This step obtains the metadata document for creating an identity provider in TrueWatch.

1) In Sign On, click Identity Provider metadata to view the identity provider metadata.

2) Right-click on the page to save it locally.

Note: The metadata document is an XML file, such as "metadata.xml".

4. Enable SSO in TrueWatch

1) To enable SSO, go to the workspace Management > Member Management > SSO Management in TrueWatch and click Enable.

Refer to the document Create SSO for more details.

Note: For account security, TrueWatch supports only one SSO configuration per workspace. If you have previously configured SAML 2.0, the last updated SAML 2.0 configuration will be treated as the default SSO login entry.

2) Upload the metadata document downloaded in Step 3, configure the Domain (email suffix domain), select the Role, and you will obtain the Entity ID and Assertion Consumer Service URL of the identity provider. You can directly copy the Login URL to log in.

Note: The domain is used for email domain mapping between TrueWatch and the identity provider to achieve SSO. The suffix domain of the user's email must match the domain added in TrueWatch.

5. Update the SAML Assertion Consumer Service URL in Okta

1) Return to Okta and update the Entity ID and Assertion Consumer Service URL from Step 2.

Note: When configuring SSO in TrueWatch, the Assertion Consumer Service URL configured in the identity provider's SAML must match the one in TrueWatch for SSO to work.

6. Configure Okta Users

Note: This step configures the authorized user email accounts for the identity provider created in TrueWatch. With the configured Okta user email accounts, users can SSO into the TrueWatch platform.

1) In Assignments > Assign, select Assign to People.

2) Select the user who needs to SSO into TrueWatch, such as "jd@qq.com", and click Assign.

3) Click Save and Go Back to complete the user configuration.

4) Return to Assignments to view the authorized Okta users.

7. Use Okta Account to SSO into TrueWatch

1) After SSO configuration is complete, log in through the TrueWatch official website or the TrueWatch console. On the login page, select SSO.

2) Enter the email address used when creating the SSO, and click Get Login URL.

3) Click the link to open the enterprise account login page.

4) Enter the corporate email and password.

5) Log in to the corresponding workspace in TrueWatch.

Note: If multiple workspaces are configured with the same identity provider SSO, after logging in via SSO, users can click the workspace selector in the upper left corner of TrueWatch to switch between different workspaces and view data.