SAML (Okta)

SAML IDP Configuration

To configure SUSE® Security to use Okta SAML IDP server, first, configure the SAML IDP server on the Okta site.

Okta

  1. Copy "SAML Redirect URI" from SUSE® Security SAML Setting page, paste it to Okta’s single sign on url, recipient url and destination url fields.

  2. Assertion encryption: This field must be unencrypted.

  3. Attribute statements: Enter the email and username attributes.

  4. Group attribute statements: Enable this if group-based role mapping is required. The default attribute name that SUSE® Security looks for is NVRoleGroup. If other attribute name is used for the user’s group membership, it can be customized in SUSE® Security’s SAML Setting page.

Configure SAML settings in SUSE® Security UI console.

SAML

Use "View Setup Instructions" button as shown in the following screenshot to locate following information, and copy them into SUSE® Security’s SAML page.

  1. Identity Provider Single Sign-On URL

  2. Identity Provider Issuer

  3. X.509 Certificate

  4. Specify group attribute name if non-default value is used.

Setting

After the user is authenticated, the proper role can be derived with group-based role mapping configuration. To setup group-based role mapping,

  1. If group-based role mapping is not configured or the matched groups cannot be located, the authenticated user will be assigned with the Default role. If the Default role is set to None, when group-based role mapping fails, the user is not able to login.

  2. Specify a list of groups respectively in Admin and Reader role map. The user’s group attribute is piggybacked in the response after the user is authenticated. If the matched group is located, the corresponding role will be assigned to the user.

Mapping Groups to Roles and Namespaces

Please see the Users and Roles section for how to map groups to preset and custom roles as well as namespaces in SUSE® Security.