Configure Single Sign-On (SSO) for Okta

Single sign-on (SSO) enables ALTR administrators to sign into the ALTR platform without having to remember a separate username, password, and two-factor authentication method. For what SSO controls at the platform level, see SSO and SCIM.

SSO authenticates existing ALTR administrators; it does not create them. Without SCIM, add your administrators in ALTR before you enable SSO.

When enabling SSO, make sure you have:

• Administrator access to your identity provider.
• Super Administrator access to your ALTR account. To check your role, see Administrators.

Configure SSO with Okta

These steps create a new application in Okta that is used to sign into ALTR. Your Okta administrator should be familiar with this process.

To configure SSO with Okta:

1. Create a new application in Okta.
   1. Sign into the Okta admin console.
   2. Click Create App Integration to create a new Okta application.
   3. Set the Sign In method to Security Assertion Markup Language (SAML) 2.0.
   4. Click Next.
   5. Under General Settings, enter an App name, such as “ALTR”. If you have multiple ALTR accounts, make the name descriptive of the account you are connecting.
   6. Click Next.
2. Identify the metadata from ALTR needed to configure SSO.
   1. Sign into your ALTR account.
   2. Select Settings > Preferences in the navigation menu.
   3. Select the SSO/SCIM tab.
   4. Copy the metadata URL and open it in a new browser tab.
   5. Identify the entityID and Location fields in the XML file.
3. Configure the SSO settings in Okta.
   1. Copy the Location field from ALTR’s metadata file (do not copy the quotation marks) and paste it into the Single sign-on URL field in Okta.
   2. Select the Use this for Recipient URL and Destination URL checkbox.
   3. Copy the entityID from ALTR’s metadata file (do not copy the quotation marks) and paste it into the Audience URI (SP Entity ID) field in Okta.
   4. Ensure the Application username field is set to Okta username.
   5. If you use ALTR’s sidecar integration, configure the SAML Settings by adding a group attribute statement:
      1. Locate Group Attribute Statements (optional).
      2. Enter groups for the Name.
      3. Select Basic as the Name format.
      4. Select Matches regex as the Filter and set it to .*.
   6. Click Next.
   7. Verify the This is an internal app that we have created checkbox is enabled.
   8. Click Finish.
4. Provision your ALTR administrators to your Okta application.
   1. In Okta, go to your ALTR application and select the Assignments tab.
   2. Select Assign > Assign to People.
   3. Locate yourself in the list of assigned users. Your Username is in the field below your name, typically shown in gray. Click Assign.
   4. Click Save and Go Back.
   5. Click Done.
   6. In ALTR, select Settings > Administrators in the navigation menu and find your Username.
   7. Ensure your ALTR Username exactly matches your Username in Okta. The match is case-sensitive. If your ALTR Username does not exactly match your Okta Username, you will not be able to sign into ALTR.
   8. Repeat these steps for each of your ALTR administrators.
5. Configure SSO in ALTR.
   1. In Okta, click the Sign On tab. Copy the Metadata URL.
   2. In ALTR, select Settings > Preferences in the navigation menu.
   3. Click the SSO/SCIM tab.
   4. Paste the metadata URL into the Provider URL field.
   5. Select Okta as your IdP.
   6. Click Enable SSO.
   7. After ALTR configures SSO, keep your current window open, open an incognito window or a different browser, and sign into your ALTR account. Do not sign out of ALTR in your main window until you have confirmed you can sign into ALTR in the second window.
   8. Once you have signed into ALTR through SSO, you can sign out of ALTR or close your browser.

Caution

Disabling SSO requires a Change Request to ALTR Support — it cannot be turned off from the ALTR UI. After SSO is disabled, each user must complete the password reset flow to set an ALTR password.