Skip to content

Commit 866c3c8

Browse files
lmkerbey-mdblmkerbey-mdb
committed
(DOCSP-35985) Refactor procedure include.
1 parent eef65cc commit 866c3c8

6 files changed

+324
-312
lines changed

‎cet/procedures/fed-auth-okta-cert.rst

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
.. procedure::
2+
:style: normal
3+
4+
.. step:: Download your |idp-provider| origination
5+
certificate.
6+
7+
.. procedure::
8+
:style: connected
9+
10+
.. step:: In your |idp-provider| account, click
11+
:guilabel:`Admin` in the upper right corner to access
12+
the Administrator environment.
13+
14+
.. step:: In the left-hand pane, navigate to
15+
:guilabel:`Applications` -> :guilabel:`Applications`.
16+
17+
.. step:: Click :guilabel:`Create App Integration`.
18+
Select :guilabel:`SAML 2.0` for the
19+
:guilabel:`Sign-in method` and click
20+
:guilabel:`Next`.
21+
22+
.. step:: Fill in the :guilabel:`App name` text field with
23+
your desired application name.
24+
25+
.. step:: Optionally, add a logo image and set app
26+
visibility. Click :guilabel:`Next`.
27+
28+
.. step:: On the :guilabel:`Configure SAML` screen, enter the
29+
following information:
30+
31+
.. list-table::
32+
:widths: 20 40
33+
:header-rows: 1
34+
35+
* - Field
36+
- Value
37+
38+
* - :guilabel:`Single sign-on URL`
39+
- ``http://localhost``
40+
41+
* - :guilabel:`Audience URI`
42+
- ``urn:idp:default``
43+
44+
.. important::
45+
46+
These are placeholder values and are **not** intended
47+
for use in production. You will replace them in a later
48+
step.
49+
50+
Leave the other fields empty or set to their default values
51+
and click :guilabel:`Next` at the bottom of the page.
52+
53+
.. step:: On the :guilabel:`Feedback` screen, select
54+
:guilabel:`I'm an Okta customer adding an internal app` and
55+
click :guilabel:`Finish`.
56+
57+
.. step:: At the bottom of the page under the heading
58+
:guilabel:`SAML Signing Certificates`, locate the newest
59+
certificate with a :guilabel:`Status` of ``Active``--this
60+
is the certificate you just created.
61+
62+
Click :guilabel:`Actions` and select
63+
:guilabel:`Download certificate` from the drop-down menu.
64+
The generated certificate is a ``.cert`` file. You must
65+
convert it to a ``.pem`` certificate for use later in this
66+
procedure. To do this, open a terminal of your choosing and
67+
run the following:
68+
69+
.. code-block:: sh
70+
71+
openssl x509 -in path/to/mycert.crt -out path/to/mycert.pem -outform PEM

‎cet/procedures/fed-auth-okta-console.rst

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
.. step:: Open the :guilabel:`Federation Management Console`.
2+
3+
.. procedure::
4+
:style: connected
5+
6+
.. step:: Log in to
7+
|service|.
8+
9+
.. step:: Use the drop-down at the top-left of |service| to
10+
select the organization for which you want to manage
11+
federation settings.
12+
13+
.. step:: Click :guilabel:`Settings` in the left navigation
14+
pane.
15+
16+
.. step:: In :guilabel:`Federated Authentication Settings`, click
17+
:guilabel:`Open Federation Management App`.

‎cet/procedures/fed-auth-okta-credentials.rst

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
.. step:: Provide |idp-provider| credentials to |service|.
2+
3+
.. procedure::
4+
:style: connected
5+
6+
.. step:: Click :guilabel:`Identity Providers` in the
7+
left-hand pane. If you have previously configured an |idp|,
8+
click :guilabel:`Add Identity Provider` in the upper-right
9+
corner of the page, then click
10+
:guilabel:`Setup Identity Provider`. If you have not
11+
previously configured an |idp|, click
12+
:guilabel:`Setup Identity Provider`.
13+
14+
.. step:: On the :guilabel:`Configure Identity Provider`
15+
screen, enter the following information:
16+
17+
.. list-table::
18+
:widths: 20 40
19+
:header-rows: 1
20+
21+
* - Field
22+
- Value
23+
24+
* - :guilabel:`Configuration Name`
25+
- Descriptive label that identifies the configuration
26+
27+
* - :guilabel:`Issuer URI`
28+
- :guilabel:`Fill with Placeholder Values`
29+
30+
* - :guilabel:`Single Sign-On URL`
31+
- :guilabel:`Fill with Placeholder Values`
32+
33+
* - :guilabel:`Identity Provider Signature Certificate`
34+
- Certificate you received from |idp-provider|
35+
in a prior step
36+
37+
* - :guilabel:`Request Binding`
38+
- ``HTTP POST``
39+
40+
* - :guilabel:`Response Signature Algorithm`
41+
- ``SHA-256``
42+
43+
.. step:: Click the :guilabel:`Next` button to see the values
44+
for the |idp-provider| configuration.
45+
46+
.. step:: Click :guilabel:`Finish`.

‎cet/procedures/fed-auth-okta-finalize.rst

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
.. step:: Replace placeholder values in the |service|
2+
|fmc|.
3+
4+
.. procedure::
5+
:style:connected
6+
7+
.. step:: On the Okta application page, click
8+
:guilabel:`View Setup Instructions`
9+
in the middle of the page.
10+
11+
.. step:: In the |service| |fmc|, navigate to the
12+
:guilabel:`Identity Providers` page. Locate your
13+
|idp-provider| and click :guilabel:`Edit`.
14+
15+
.. step:: Replace the placeholder values in the following
16+
fields:
17+
18+
.. list-table::
19+
:widths: 20 40
20+
:header-rows: 1
21+
22+
* - FMC Data Field
23+
- Value
24+
25+
* - :guilabel:`Issuer URI`
26+
- :guilabel:`Identity Provider Issuer` value from
27+
the Okta Setup Instructions page.
28+
29+
* - :guilabel:`Single Sign-on URL`
30+
- :guilabel:`Identity Provider Single Sign-On URL`
31+
value from the Okta Setup Instructions page.
32+
33+
* - :guilabel:`Identity Provider Signature Certificate`
34+
- Copy the :guilabel:`X.509 Certificate` from the
35+
Okta Setup Instructions page and paste the contents
36+
directly.
37+
38+
.. step:: Click :guilabel:`Next`.
39+
40+
.. step:: Click :guilabel:`Finish`.
41+
42+
.. step:: Assign users to your |idp-provider|
43+
application.
44+
45+
.. procedure::
46+
:style:connected
47+
48+
.. step:: On the Okta application page, click the
49+
:guilabel:`Assignments` tab.
50+
51+
.. step:: Ensure that all your |service| organization users
52+
who will use Okta are enrolled.

‎cet/procedures/fed-auth-okta-saml.rst

Lines changed: 138 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,138 @@
1+
.. step:: Configure your SAML integration.
2+
3+
.. procedure::
4+
:style: connected
5+
6+
.. step:: In your |idp-provider| account, return to the page
7+
for your SAML application and ensure the :guilabel:`General`
8+
tab is selected.
9+
10+
.. step:: In the :guilabel:`SAML Settings` pane, click
11+
:guilabel:`Edit`.
12+
13+
On the :guilabel:`General Settings` page, click
14+
:guilabel:`Next`.
15+
16+
.. step:: On the :guilabel:`Configure SAML` screen, enter the
17+
following information:
18+
19+
.. list-table::
20+
:widths: 20 40
21+
:header-rows: 1
22+
23+
* - Okta Data Field
24+
- Value
25+
26+
* - :guilabel:`Single sign on URL`
27+
- :guilabel:`Assertion Consumer Service URL` from the
28+
|service| FMC.
29+
30+
Checkboxes:
31+
32+
- Check :guilabel:`Use this for Recipient URL and Destination URL`.
33+
- Clear :guilabel:`Allow this app to request other SSO URLs`.
34+
35+
* - :guilabel:`Audience URI (SP Entity ID)`
36+
- :guilabel:`Audience URI` from the |service| FMC.
37+
38+
* - :guilabel:`Default RelayState`
39+
- .. include:: /includes/optional-idp-relay-state-step.rst
40+
41+
* - :guilabel:`Name ID format`
42+
- Unspecified
43+
44+
* - :guilabel:`Application username`
45+
- Email
46+
47+
* - :guilabel:`Update application username on`
48+
- Create and update
49+
50+
.. step:: Click the :guilabel:`Click Show Advanced Settings` link in the
51+
Okta configuration page and ensure that the following values are
52+
set:
53+
54+
.. list-table::
55+
:widths: 20 40
56+
:header-rows: 1
57+
58+
* - Okta Data Field
59+
- Value
60+
61+
* - :guilabel:`Response`
62+
- ``Signed``
63+
64+
* - :guilabel:`Assertion Signature`
65+
- ``Signed``
66+
67+
* - :guilabel:`Signature Algorithm`
68+
- ``RSA-SHA256``
69+
70+
* - :guilabel:`Digest Algorithm`
71+
- ``SHA256``
72+
73+
* - :guilabel:`Assertion Encryption`
74+
- ``Unencrypted``
75+
76+
.. step:: Leave the remaining :guilabel:`Advanced Settings` fields in their
77+
default state.
78+
79+
.. step:: Scroll down to the :guilabel:`Attribute Statements (optional)`
80+
section and create four attributes with the following values:
81+
82+
.. list-table::
83+
:widths: 20 40 40
84+
:header-rows: 1
85+
86+
* - Name
87+
- Name Format
88+
- Value
89+
90+
* - firstName
91+
- Unspecified
92+
- ``user.firstName``
93+
94+
* - lastName
95+
- Unspecified
96+
- ``user.lastName``
97+
98+
.. important::
99+
100+
The values in the **Name** column are case-sensitive. Enter
101+
them exactly as shown.
102+
103+
.. note::
104+
105+
These values may be different if Okta is connected to an Active
106+
Directory. For the appropriate values, use the Active Directory
107+
fields that contain a user's first name, last name, and full
108+
email address.
109+
110+
.. step:: (Optional) If you plan to use
111+
:doc:`role mapping </security/manage-role-mapping/>`,
112+
scroll down to the
113+
:guilabel:`Group Attribute Statements (optional)` section
114+
and create an attribute with the following values:
115+
116+
.. list-table::
117+
:widths: 25 25 25 25
118+
:header-rows: 1
119+
120+
* - Name
121+
- Name Format
122+
- Filter
123+
- Value
124+
125+
* - memberOf
126+
- Unspecified
127+
- Matches regex
128+
- ``.*``
129+
130+
This filter matches all group names associated with the user.
131+
To filter the group names sent to Atlas further,
132+
adjust the :guilabel:`Filter` and :guilabel:`Value` fields.
133+
134+
.. step:: Click :guilabel:`Next` at the bottom of the
135+
page.
136+
137+
.. step:: On the :guilabel:`Feedback` screen,
138+
click :guilabel:`Finish`.

0 commit comments

Comments
 (0)