Okta Single Sign-On Integration with SAML

Okta is an identity and access management platform. Its Single Sign-On (SSO) solution allows users to log into a variety of systems using one centralized process.

This document explains how to configure Okta and Invicti Platform for Single Sign-On.

How to configure Okta with SAML

There are two steps in this process:

• Step 1: Add an application to Okta
• Step 2: Add users to the application in Okta

Step 1: Add an application to Okta

1. Navigate to Okta’s Admin Console, then select Applications > Applications from the left-side menu.
2. Click Create App Integration.
3. From the Create a new app integration dialog, select SAML 2.0. Then click Next.

4. On the Create SAML Integration page, enter a name in the App name field. We use Invicti for this example.
5. Select Next.
6. In a new browser tab, login to Invicti Platform and select Settings > Security & Access Control > SSO.  
7. Turn on the Enable SSO toggle.
8. Select Okta from the SSO Provider dropdown list.
9. Copy the SAML 2.0 Service URL and paste the URL into Okta’s Single Sign-on URL field.
10. Return to the Invicti browser tab and copy the Identifier URL. Paste it into Okta’s Audience URI (SP Entity ID) field.

11. In the Okta tab, add the following FirstName field in the Attribute Statements and select user.firstName value from dropdown.

12. Click Next to view the Feedback tab.
13. Click Finish. You will see the Invicti application’s details.
14. In the Sign On tab click View SAML setup instructions. Okta opens a new browser tab.
15. From the new tab, copy the URL from the Identity Provider Issuer and paste the URL to Invicti’s IdP Identifier field.
16. In the Okta tab, copy the URL from the Identity Provider Single Sign-On URL and paste it to Invicti’s SAML 2.0 Endpoint field.
17. In the Okta tab, copy the content from the X.509 Certificate field. Then switch to the Invicti tab and paste the URL to the X.509 Certificate field.

18. In Invicti, select the checkboxes for signed assertions, encrypted assertions, or sign requests as needed.

19. If you enable any assertions or requests, a new section appears where you can Generate a new certificate or upload an existing one.

20. Use the Invicti’s SSO Exemptions dropdown to select users who can log in to Invicti via password.

21. Click Save.

Configure encrypted assertions in Okta

1. From the Okta’s main menu, go to Applications > Invicti.
2. Select the General tab and scroll down to the SAML Settings section. Click Edit.
3. Click Next, then Show Advanced Settings.
4. Use the dropdown next to Assertion Encryption to select Encrypted.
5. Click Browse Files next to Encryption Certificate and upload your Invicti certificate.

Step 2: Add users to the application in Okta

1. Select Directory > People from the left-side menu in Okta.
2. Click the Add Person button to open a form.
3. Fill out the form.
4. Click Save.
5. Select Applications > Applications from the left-side menu.
6. Select Invicti from the list.
7. In the Assignments tab, click Assign > Assign to People.
8. From the Assign Invicti to People dialog, select Assign next to the person you want to add.
9. Select Save and Go Back.
10. Click Done.

Your assigned users can now log in to Invicti via Okta.