Okta SAML authentication

Configure Polygraph as a separate Okta app integration from your Nx Cloud SAML app. The SAML setup is the same except for the single sign-on URL and audience URI. You can assign the same groups and users to both app integrations.

Set up SAML

1. In the Okta Admin Console, go to Applications > Applications, then select Create App Integration.

   

2. Select SAML 2.0, then select Next.

   

3. Enter a name such as Polygraph, then select Next.

   

4. Configure the SAML settings:

   1. Set Single sign-on URL to <POLYGRAPH_APP_URL>/auth-callback. Your developer productivity engineer (DPE) provides POLYGRAPH_APP_URL.
   2. Select Use this for Recipient URL and Destination URL.
   3. Set Audience URI (SP Entity ID) to polygraph-private-cloud.
   4. Leave Default RelayState empty.

   

5. Under Advanced Settings, configure the signatures:

   1. Set Response to Signed.
   2. Set Assertion Signature to Signed.
   3. Set Signature Algorithm to RSA-SHA256.
   4. Set Digest Algorithm to SHA256.

   

6. Under Attribute Statements, add these attributes:

   Name	Name format	Value
   id	Unspecified	user.email
   email	Unspecified	user.email

   

7. Select Next, select I'm an Okta customer adding an internal app, then select Finish.

8. Open the Assignments tab and assign the groups or users that can sign in to Polygraph. You can assign the same groups and users that use your Nx Cloud SAML app.

   

9. Open the Sign On tab and find SAML Signing Certificates. From the certificate with the Active status, select Actions > Download certificate.

   

10. Convert the downloaded certificate into the one-line value for POLYGRAPH_SAML_CERT:

    awk 'NF {sub(/\r/, ""); printf "%s\\n",$0;}' okta.cert

11. From the active certificate, select Actions > View IdP metadata.

    

12. Find the SingleSignOnService element that uses the HTTP-POST binding and copy its Location URL. This URL is the value for POLYGRAPH_SAML_ENTRY_POINT.

    <md:SingleSignOnService
      Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
      Location="https://<your-okta-domain>/app/<your-polygraph-app>/<app-id>/sso/saml"
    />

    

13. If you plan to configure Universal Logout, copy the entityID attribute from the EntityDescriptor element in the IdP metadata.

    

Configure universal logout

Universal Logout is optional and lets Okta revoke a user's active Polygraph sessions and credentials.

1. In the Okta Admin Console, go to Applications and Resources > Applications and select the Polygraph app.

2. Open the General tab.

   

3. In the Logout section, select Edit.

4. Select Okta system or admin initiates logout.

5. Set Endpoint URL to <POLYGRAPH_APP_URL>/saml/global-token-revocation.

6. Keep Endpoint authentication type set to Signed JWT.

7. Set Subject format to Email Identifier.

8. Select Save.

   

Information to exchange with your DPE

Your DPE provides the Polygraph app URL (POLYGRAPH_APP_URL) used for the single sign-on URL.

Send these values to your DPE after you configure SAML:

1. SAML certificate, the one-line certificate string from the active Okta signing certificate.
2. SAML entry point, the HTTP-POST SingleSignOnService URL from the IdP metadata.
3. Okta entity ID, the entityID from the EntityDescriptor element, if you configure Universal Logout.