Use Okta for SSO authentication

First, you’ll need to save a copy of your Kobiton SSO attributes so you can easily add them to your IdP later.

Select your profile name or picture, then choose Settings.

Choose SSO Settings.

From Basic configuration, copy the following values and save them to a note:

From User attributes (or parameters), copy the following values and save them to a note:

Later you’ll finish configuring your Kobiton SSO settings so keep this browser window open.

In Okta, select Admin.

Okta may ask you to sign in again.

In the Admin Console, select Applications, then select Applications from the submenu.

Select Create App Integration.

In the Create a new app integration window, select SAML 2.0, then select Next.

In General Settings, enter an App name. Optionally, add a logo to customize your sign-in portal. Then select Next.

In the Configure SAML Integration window, use your Kobiton SSO parameters to fill the following fields.

In Single sign-on URL, enter the Kobiton reply URL.

For Audience URI (SP Entity ID), enter the Kobiton entity ID.

For Default RelayState, enter the value from the Kobiton SSO basic configuration.

Select Next.

On the feedback page, select an App type.

For internal apps, select This is an internal app that we have created.

Answer any optional feedback questions, then select Finish.

Okta opens the app configuration page.

On the Okta app configuration page, select the Sign On tab.

In the SAML 2.0 section, expand Show legacy configuration to display the attribute statement settings.

In Profile attribute statements, add the following attributes. For each row, enter the name into Name, select Basic from the Name format drop-down list, and select the corresponding value from the Value drop-down list.

In Group attribute statements, add the following attribute. For Filter, select Matches regex from the drop-down list and enter .* in the adjoining field.

Each name and value must match the corresponding attribute in your Kobiton portal SSO settings tab exactly. Select Copy next to each attribute in the Kobiton portal to copy the value to your clipboard.

Select Save.

Optionally, select Preview the SAML assertion to review it before continuing.

On the Sign On tab, go to the About section to the right of the Settings panel, then select View SAML setup instructions.

From the setup instructions page, copy and save the following values:

Use these values when you configure the Okta IdP settings in Kobiton:

The optional IdP metadata XML contains the same Okta IdP configuration in a machine-readable format. If the setup instructions page provides the IdP values separately, use those fields instead of manually parsing the XML.

To download the certificate file, return to the Okta app configuration page. On the Sign On tab, go to the SAML Signing Certificates section. Under Actions, select Download certificate.

Assign users in Okta so they can sign in to Kobiton through SSO. Each user’s Username in Okta must match the email address on their Kobiton account exactly.

On the Okta app configuration page, select the Assignments tab.

Select Assign, then select Assign to People.

In the people list, select Assign next to the user’s Okta account.

In the assignment window, confirm the Username field contains the user’s Kobiton account email address. If it doesn’t, enter the email exactly as it appears in Kobiton.

Select Save and Go Back, then select Done.

The assigned user appears in the Assignments panel.

To assign additional users, select Assign again and repeat these steps.

To confirm a user’s Kobiton account email, check the Kobiton portal.

Now, you’ll need to add your IdP parameters and certificate to your Kobiton organization. In your SSO Settings, scroll down to Set up at Kobiton side.

Add your IdP parameters and certificate to the following:

See the below mapping table for which value to use for each parameter above.

Select Verify to test your SSO configuration.

The system will open a new browser tab to the SSO login page. In this new tab, log in using the account that has the same email as the current Kobiton account.

If logged in successfully, go back to the previous browser tab with the SSO Settings opened.

Wait for a while for the SSO Settings page to automatically reload (do not force reload the page) and a success message displays like the below:

After receiving the success response, select Save to complete your SSO configuration.

After verifying and saving the configuration, you can turn on Enforce users to login to Kobiton only through SSO to force the users to log in only via SSO (optional).

When SSO login enforcement is turned on: