Details of the steps required to configure a SSO between Edflex and OKTA Workforce Identity Cloud based on SAML and OIDC protocols.
Learn how to set up an automatic login (SSO). This will allow your learners to not have to login manually to Edflex if they are already logged into your OKTA directory.
1. Add an Enterprise Application
From the OKTA overview, on the left menu, click Applications then Create App Integration.
Select the protocol of your choice: OIDC - OpenID Connect or SAML 2.0 (Edflex supports both protocols.
If you have no preference, we suggest SAML 2.0).
1.1 Using SAML 2.0 protocol
Enter a name for this application:
Then complete the General section as follows:
- Single-sign-on URL > Enter the URL ACS sent by Edflex.
- Audience URI (SP Entity ID) > Enter the URL Entity ID sent by Edflex.
You will specify in return to your Edflex technical contact, the values set for the field:
- Name ID Format (suggested value > "Unspecified")
Then, under Attribute Statements (optional), set up the fields as follow:
- email > "Unspecified" format > Value = user.email
- firstName > "Unspecified" format > Value = user.firstname
- lastName > "Unspecified" format > Value = user.lastname
Share with your Edflex technical contact, attributes values available in the "Name" column.
Please make sure that fields' case and nomenclature you create match the Edflex configuration.
If you want to set up additional fields, please let us know!
Save your configuration!
1.2 Using OIDC - OpenID Connect protocol
If you select OIDC protocol, then select "Web application":
Then, in the "Assignments" section > "Control access", select the settings of your choice.
Follow the path: "Applications" > "Applications" > "General", copy/paste the Client ID and Client Secrets which you will forward to your Edflex technical contact.
For security reasons, we recommend sending this data via secure sharing (using a 1password link, for example).
Please also send your Edflex technical contact the name of your OKTA instance. This will enable us to easily retrieve the parameters from your instance and match them on the Edflex side.
What is the name of my OKTA instance?
In the browser's URL bar, this is the part before .okta.com (in pink in the image below).
By default, the OIDC connection will automatically send this user information: email, first name, last name.
If you want to synchronize additional attributes between Edflex and your OKTA instance, please specify the name of the scope(s) concerned, as well as values involved in this/these scope(s).
2. Restrict access to a user group
Add one or more user groups to restrict access to the Edflex application.
From the left-hand menu, select "Applications " > "Applications " then "People " or "Groups ", depending on whether you want to assign learners individually or via groups created in your Okta instance.
Click on "Assign " and follow the assignment process.
Assignments can also be made via the "Directory " > "People " section.
Please note that if no groups or users are added, you will not be able to connect to Edflex.
3. SSO configuration
3.1 Via SAML 2.0 protocol
From the left-hand menu, select "Applications" > "Applications" > "SAML 2.0" > section "SAML 2.0", copy the url of the Metadata file and send it to your Edflex technical contact.
...
...
...
For security reasons, please forward this file to your Edflex technical contact via a secure share (using a 1password link, for example).
On receipt of the file, Edflex will carry out the final configuration steps and notify you when the configuration is complete. 🚀
3.2 Via OIDC - OpenID Connect protocol
In the "General" > "General Settings" > "Login" section, enter the Redirect URI transmitted by Edflex.
Configuration is complete 🚀