1Kosmos as an External Identity Provider in Okta

The steps to configure 1Kosmos as an External Identity Provider (IdP) with an Okta Service Provider (SP) using SAML for authentication.

Roles in this integration

• Identity Provider (IdP): 1Kosmos
• Service Provider (SP): Okta
• Protocol: SAML

Configuring SAML

To configure SAML, complete the following tasks.

Add a SAML Identity Provider

1. In the Okta Admin Console, navigate to Security > Identity Providers.
2. Click Add identity provider, then select SAML 2.0 IdP.
3. Click Next.
4. Configure the General Settings:

   Field	Description
   Name	Enter a name for the IdP.

5. Configure the Authentication Settings:

   Field	Description
   IdP Usage	Select an authentication method: SSO only for single sign-on, or Factor only for multi-factor authentication.
   Account matching with Persistent Name ID	Select Use Persistent Name ID (Higher Security) to determine the associated user account by matching the Name ID with the External ID. If no match is found, Okta uses the IdP username value for account matching.

6. Configure the Account matching with IdP Username options:

   Field	Description
   IdP username	Select the entity in the SAML assertion that contains the username.
   Filter	Select Only allow usernames that match defined RegEx Pattern to enter an expression as a username filter.
   Match against	Select the user attribute to match against the IdP username.
   Account link policy	Select Enable automatic linking to automatically link the user's IdP account with a matching Okta account.
   IdP Issuer URI	Enter the issuer URI from the IdP.
   IdP Single Sign-On URL	Enter the sign-on URL from the IdP.
   IdP Signature Certificate	Upload the certificate from the IdP used to sign the assertion. Click Browse files, select the file, then click Open.
   Request Binding	Select the SAML Authentication Request Protocol binding Okta uses to send SAML authorization request messages to the IdP.
   Request Signature	Select Sign SAML Authentication Requests to sign the request messages sent by Okta. If selected, Okta automatically sends the authorization request to the URL specified in the IdP Single Sign-On URL field.
   Response Signature Verification	Select the type of response signatures Okta accepts when validating incoming responses: Response, Assertion, or Response or Assertion.
   Response Signature Algorithm	Select the signature algorithm Okta uses to validate SAML messages and assertions from the IdP: SHA-1 or SHA-256.
   Destination	Enter the destination attribute Okta includes in the SAML authorization request.
   Okta Assertion Consumer Service URL	Specify whether to use a trust-specific assertion consumer service (ACS) URL or one shared across the organization: Trust-specific or Organization (shared).
   Max Clock Skew	Specify how long the assertion remains valid.

7. Click Finish. After creating the IdP, click Download metadata to access the Okta SAML metadata for the 1Kosmos provider.

Configure Identity Provider routing rules

You can configure routing rules for each identity provider or for different combinations of user criteria.

1. In the Okta Admin Console, navigate to Security > Identity Providers.
2. On the Routing Rules tab, click Add Routing Rule.
3. Enter a Rule Name.
4. Configure the routing conditions:

   Field	Description
   IF User's IP is	Select a network zone.
   AND User's device platform is	Select the device that can be used for configuring rules.
   AND User is accessing	Select the type of application the user should access.
   AND user matches	Select the login attributes the user should match.
   THEN Use this Identity provider	Select the IdP to use when all conditions are met.

5. Click Create rule and indicate whether you want to activate the rule immediately.
6. To activate the rule, click Activate.

Configuring applications on 1Kosmos

You can configure Okta applications with 1Kosmos using either of the following methods.

Using SAML 2.0 Generic

1. Log in to the 1Kosmos tenant as a community administrator.
2. Navigate to Applications > Add Applications.
3. In the Saml 2.0 Generic tile, click Add Integration.
4. On the wizard page, click Add Application.
5. In Basic Settings, specify the application name, its URL, and the instance to which the configuration applies, then click Next.
6. In SAML Settings, go to the Assertion Statement (NameID) section, select the format of the NameID and its value, then click Next.
7. In Advanced Options, specify the entity ID and the Assertion Consumer Service (ACS) details, then click Save.

Using the Okta integration (prebuilt)

1. Log in to the 1Kosmos tenant as a community administrator.
2. Navigate to Applications > Add Applications.
3. In the Pre-built integrations section, click Add integration under the Okta tile.
4. On the Okta page, enter the application name, service provider name, and the Okta API token, then click Connect. The added application appears on the Manage applications home page.

Note: You can use the Okta API token link under the Before we begin section on the Okta page to generate a token.

Testing the integration

1. Open the application URL.
2. You are redirected to the 1Kosmos Login page.
3. Use the 1Kosmos app to scan the QR code. You are redirected to the landing page of the Okta application.