Skip to main content

SSO/SAML Setup: Okta

Note: DataGrail only supports connections with SAML v2.0.

Standard Configuration For SSO​

This section documents the standard configuration for Okta as an identity provider to support login to the DataGrail app. This configuration requires all users be provisioned directly in DataGrail.

  1. Sign in to Okta as an admin.

  2. Click on Applications -> Applications in the left-hand menu.

  3. Select Browse App Catalog.

  4. Type in ‘DataGrail’ -> Select 'DataGrail' from the dropdown. Screen_Shot_2022-11-16_at_3.45.36_PM.png

  5. Select the Add Integration.

  6. Enter your subdomain.

    • If you login to DataGrail at yourcompanyname.datagrail.io, your subdomain would be yourcompanyname; If you are unclear on what your subdomain would be, please confirm with your CSM or reach out to support@datagrail.io.

    Screen_Shot_2022-11-16_at_4.37.28_PM.png

  7. Click on Done button.

  8. When redirected back to the Applications Page, click on the DataGrail Application and then the Sign On tab. Screen_Shot_2022-11-16_at_3.50.07_PM.png

  9. Scroll to SAML Signing Certificates section.

  10. You should see an active certificate that is automatically created. This is a signing certificate that will sign the SAML assertions. Click on the Actions dropdown and View IdP Metadata (this should open in another tab). Screen_Shot_2022-11-16_at_3.52.20_PM.png

  11. Copy the URL of the Identity Provider Metadata. Screen_Shot_2021-06-07_at_2.02.04_AM.png

  12. Send the metadata URL to DataGrail at support@datagrail.io.

info

Please visit Inviting New Users with Okta for more instructions on adding users and managing roles.

Okta Group Provisioning For SSO​

The Group Provisioning functionality is best for advanced users that would like to provision roles automatically based on group assignments within Okta.

Creating the Okta App​

  1. Sign in to Okta as an admin.

  2. Click on Applications -> Applications in the left-hand menu.

  3. Select Create App Integration and choose SAML 2.0.

  4. Name the app and select next.

  5. Enter the SAML Settings:

    • Single Sign On URL: https://<DataGrail Subdomain>.datagrail.io/saml/auth
    • Audience URI (SP Entity ID): https://<DataGrail Subdomain>.datagrail.io/saml/metadata
    • <DataGrail Subdomain> should be replaced with the subdomain configured for your account (i.e. 'newcustomer' for newcustomer.datagrail.io). If you are unclear on what your subdomain would be, please confirm with your CSM or reach out to support@datagrail.io.

  6. Select next and create the application.

  7. Scroll to SAML Signing Certificates section.

  8. You should see an active certificate that is automatically created. This is a signing certificate that will sign the SAML assertions. Click on the Actions dropdown and View IdP Metadata (this should open in another tab) Screen_Shot_2022-11-16_at_3.52.20_PM.png

  9. Copy the URL of the Identity Provider Metadata Screen_Shot_2021-06-07_at_2.02.04_AM.png

  10. Send the metadata URL to DataGrail at support@datagrail.io.

Determining Group Mappings​

In order to utilize the Group Mapping functionality, mappings between the Okta groups and DataGrail roles must be configured on the DataGrail side.

Please review the DataGrail Roles and Permissions and determine what roles you want to associate with your Okta groups. You can have multiple Okta groups map to the same DataGrail role.

Once you have established your mappings, please send them support@datagrail.io to be configured.

Configuring Attribute Statements​

Once DataGrail support confirms the mappings have been set, the attribute statements can now be configured within Okta:

  1. Navigate back to the Okta app you created in the first section and select the General tab.

  2. Select Edit in the SAML Settings section.

  3. Select Next to get to the Configure SAML tab. Scroll down to Group Attribute Statements.

  4. For each of the mappings you have defined, create a new attribute statement with the name roles and utilize the filters to associate this with the correct group.

Okta Group Attribute Statements

  1. Additionally, scroll up to Attribute Statements and configure the following attribute statements:

    • First Name
      • Name: first_name
      • Value: user.firstName
    • Last Name
      • Name: last_name
      • Value: user.lastName
    • Email
      • Name: email
      • Value: user.email

  2. Select Next and save your changes.

info

Please visit Inviting New Users with Okta for more instructions on adding users and managing roles.

Okta Just-in-Time Provisioning (JIT) For SSO​

The Just-in-Time Provisioning functionality is best for advanced users that would like to provision roles on a per-user basis directly in Okta.

Creating the Okta App​

  1. Sign in to Okta as an admin.

  2. Click on Applications -> Applications in the left-hand menu.

  3. Select Create App Integration and choose SAML 2.0.

  4. Name the app and select next.

  5. Enter the SAML Settings:

    • Single Sign On URL: https://<DataGrail Subdomain>.datagrail.io/saml/auth
    • Audience URI (SP Entity ID): https://<DataGrail Subdomain>.datagrail.io/saml/metadata
    • <DataGrail Subdomain> should be replaced with the subdomain configured for your account (i.e. 'newcustomer' for newcustomer.datagrail.io). If you are unclear on what your subdomain would be, please confirm with your CSM or reach out to support@datagrail.io.

  6. Select next and create the application.

  7. Scroll to SAML Signing Certificates section.

  8. You should see an active certificate that is automatically created. This is a signing certificate that will sign the SAML assertions. Click on the Actions dropdown and View IdP Metadata (this should open in another tab) Screen_Shot_2022-11-16_at_3.52.20_PM.png

  9. Copy the URL of the Identity Provider Metadata Screen_Shot_2021-06-07_at_2.02.04_AM.png

  10. Send the metadata URL to DataGrail at support@datagrail.io. Please inform DataGrail support that you will be utilizing JIT Provisioning, so that it can be enabled on your account.

Configuring The User Profile​

In order to use Okta to send roles to DataGrail, a new attribute must be added to your default user profile.

  1. In the left-hand menu, select Directory and Profile Editor. Locate and select your default profile. Okta Default Profile

  2. Select Add Attribute and enter the following:

    • Data Type: string
    • Display Name: DataGrail Role
    • Variable Name: datagrail_roles
    • Description: DataGrail user role.

Okta User Attributes

  1. Select save.

Configuring Attribute Statements​

  1. Navigate back to the Okta app you created in the first section and select the General tab.

  2. Select Edit in the SAML Settings section.

  3. Select Next to get to the Configure SAML tab. Scroll down to Attribute Statements and configure the following attribute statements:

    • First Name
      • Name: first_name
      • Value: user.firstName
    • Last Name
      • Name: last_name
      • Value: user.lastName
    • Email
      • Name: email
      • Value: user.email
    • Roles
      • Name: roles
      • Value: user.datagrail_roles

  4. Select Next and save your changes.

info

Please visit Inviting New Users with Okta for more instructions on adding users and managing roles.



Disclaimer: The information contained in this message does not constitute as legal advice. We would advise seeking professional counsel before acting on or interpreting any material.