Using Okta as Your Identity Provider

Updated

To integrate with Okta, add a SAML application in your Okta account and in the Command Center. Metadata from the Okta application is shared with the Command Center application during this process.

Okta is a third-party identity provider (IdP) that can act as the IdP when your users log on to Commvault. Commvault is the service provider (SP).

Create an Application in Okta

Create a new application using SAML 2.0 as the sign-on method.

  1. Log on to your Okta account.

  2. From the navigation pane, click Applications.

  3. Click Create App Integration, and then select SAML 2.0.

  4. Click Next.

    The Create SAML Integration page appears.

  5. On the General Settings tab, in the App name box, enter a name for the application.

  6. Click Next.

  7. Under Configure SAML > SAML Settings, in the Single sign on URL box and the Audience URI (SP Entity ID) box, enter the URL for the Web Console.

  8. From the Name ID format list, select Email Address.

  9. Continue to follow the prompts, accepting the default values.

  10. Click Finish.

  11. Open the application, and then click Sign On.

  12. Under the View Setup Instructions button, click Identity Provider metadata, and then save the IdP metadata file as an XML file.

    The identity provider metadata file that you save is the IdP metadata file that you will upload to Commvault.

  13. Keep your Okta account open.

    The value in the Single sign on URL box in Okta must be updated after a new URL is created in Commvault.

Add a SAML Application in Commvault

  1. From the navigation pane, go to Manage > Security > Identity server.

    The Identity servers page appears.

  2. In the upper-right corner of the page, click Add.

    The Add domain dialog box appears.

  3. Click SAML.

  4. In the Name box, enter the domain name that you want to associate users with.

    Note

    • The SAML application is created using the domain name.

    • If you want to add a SAML application for the users of the Active Directory (AD) that is configured in the CommCell environment, then enter the AD NetBIOS name. During the SAML authentication, AD is contacted to collect the user details such as email address, UPN, Full Name, User Group, and so on.

  5. In the Email Suffix box, enter the email suffix of the users.

    For example, if the username is jpadilla@gmail.com, then the email suffix is gmail.com.

    Note

    • You can enter multiple email suffixes separated by a comma.

    • Only users that have specified email suffix can log on using this app.

  6. In the Upload IDP metadata box, browse to the XML file that contains the IdP metadata, and then click Open.

  7. Review the value in the Webconsole url box.

    This value is automatically generated and is used in the SP metadata file. The format of the value is https://mycompany:443/webconsole.

  8. If you are an MSP administrator creating the SAML app for a company, in the Created for company box, select the company.

    If you are creating the SAML app for the entire CommCell environment or if you are a tenant administrator, a company is not needed.

  9. To digitally sign the SAML message, move the Auto generate key for digital signing of SAML messages toggle key to the right.

  10. Click Save.

    The Identity servers page appears.

  11. In the Name column, click the identity server.

    The identity server page appears.

  12. In the General section, copy the value in the Single sign on url box.

Update the Single Sign-On URL in Okta

  1. In your Okta account, select the SAML application.

  2. On the General tab, in the SAML Settings tile, click Edit.

  3. Follow the prompts to specify the general settings.

  4. Under Configure SAML > SAML Settings, in the Single sign on URL box, paste the URL that you copied from the Single sign on URL box in the Command Center.

Optional Okta Configurations

Configure Single Log Out in Okta

  1. From the generated SP metadata XML file, copy the following information:

    • SP EntityId

    • SingleLogoutService location with POST binding

  2. To download the signature certificate, log on to the Command Center, and then in your web browser, enter the SAML App URL in the following format:

    https://webconsole_hostname/adminconsole/downloadSPCertificate.do?appName=URL encoded SAML app name

    For example, enter https://company.com/adminconsole/downloadSPCertificate.do?appName=app%20Name.

  3. Press Enter.

  4. In your Okta account, under General > Advanced Settings, select the Enable Single Logout box.

  5. In the Single Logout URL box, enter the SingleLogoutService location that you copied from the SP metadata XML file.

  6. In the SPIssuer box, enter the entityID that you copied from the SP metadata XML file.

  7. In the Signature Certificate box, upload the certificate that you downloaded from the SAML app URL.

Give Other Okta Users Access to the Okta Account

  1. In your Okta account, under Assignments, click Assign, and then select one of the following options:

    • To give access to individual Okta users, click Assign to People.

    • To give access to a user group, click Assign to Groups.

  2. Select the user or user group that you want to give access to, and then click Add.

Assign Domain Users Based on the Okta User Groups SAML Attribute

  1. In your Okta account, under Group Attribute Statements, click Add.

  2. In the Name box, enter user_groups.

  3. In the Filter box, assign filters as required.

    For example, to assign users from a user group name that starts with "domain users", select Starts With, and then enter domain users.

  4. Preview the SAML assertion, and verify that your IdP response XML includes the user group attribute.

    For example:

    <saml2:Attribute Name="user_groups" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified">  <saml2:AttributeValue

    xmlns:xs="http://www.w3.org/2001/XMLSchema"

    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">GroupName Match Starts with "domain users" (ignores case)

    </saml2:AttributeValue>

    </saml2:Attribute>
  5. In the Command Center, map Okta's user_group SAML attribute with the user group user attribute.

    For information about mapping attributes, see Mapping SAML Attributes.