> For the complete documentation index, see [llms.txt](https://docs.1kosmos.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.1kosmos.com/integrations/authentication/external-identity-provider-sso-federation/setting-up-1kosmos-as-an-identity-provider.md). # Setting Up 1Kosmos as an Identity Provider *** ### Configuring SAML To configure SAML, you must perform the following tasks: #### Adding a SAML Identity Provider To add SAML as an Identity Provider, follow these steps: 1. In the Admin Console, navigate to **Security > Identity Providers**. 2. Click **Add identity provider**, and then select **SAML 2.0 IdP**. 3. Click **Next**. 4. Configure the **General Settings** options. | Field | Description | | ----- | ------------------------- | | Name | Enter a name for the IdP. | 5. Configure the **Authentication Settings** options. | Field | Description | | ---------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | IdP Usage | Select an authentication method. The following values are available to select: **SSO only** — use this option for the single sign-on; **Factor only** — use this option for multi-factor authentication. | | Account matching with Persistent Name ID | Select the **Use Persistent Name ID (Higher Security)** check box to determine the associated user account by matching the Name ID with the External ID. If no match is found, Okta uses the **IdP username** value for account matching. | 6. Configure the **Account matching with IdP Username** options. | Field | Description | | ----------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | IdP username | Select the entity in the SAML assertion that contains the username. | | Filter | Select the **Only allow usernames that match defined RegEx Pattern** check box if you want to enter an expression as a username filter. | | Match against | Select the user attribute to match against the IdP username. | | Account link policy | Select the **Enable automatic linking** check box to automatically link the user's IdP account with a matching Okta account. | | IdP Issuer URI | Enter the issuer URI from the IdP. | | IdP Single Sign-On URL | Enter the sign-on URL from the IdP. | | IdP Signature Certificate | Upload the certificate from the IdP that's used to sign the assertion. Click **Browse files**, select the certificate file, and then click **Open**. | | Request Binding | Select the appropriate SAML Authentication Request Protocol binding that Okta uses to send SAML authorization request messages to the IdP. | | Request Signature | Select the **Sign SAML Authentication Requests** option to sign the SAML authorization request messages sent by Okta. If this option is selected, Okta will automatically send the authorization request to the URL specified in the IdP Single Sign-On URL field. | | Response Signature Verification | Select the type of response signatures that Okta will accept when validating incoming responses. The following values are available to select: **Response**, **Assertion**, **Response or Assertion**. | | Response Signature Algorithm | Select the signature algorithm that Okta uses to validate the SAML messages and assertions that it receives from the IdP: **SHA-1** or **SHA-256**. | | Destination | Enter the destination attribute that Okta includes in the SAML authorization request. | | Okta Assertion Consumer Service URL | Select an option to specify whether to use a trust-specific assertion consumer service (ACS) URL or one that is shared across the organization. The following values are available to select: **Trust-specific** or **Organization (shared)**. | | Max Clock Skew | Specify the duration for how long the assertion remains valid. | 7. Click **Finish**. After creating an IdP, click **Download metadata** to access the Okta SAML metadata for the 1Kosmos provider. #### Configuring Identity Provider Routing Rules You can configure routing rules for each identity provider or for different combinations of user criteria. To configure the routing rules, follow these steps: 1. In the Admin Console, navigate to **Security > Identity Providers**. 2. On the **Routing Rules** tab, click **Add Routing Rule**. 3. Enter a **Rule Name**. 4. Configure the routing conditions. | Field | Description | | ------------------------------- | ---------------------------------------------------------- | | IF User's IP is | Select a network zone. | | AND User's device platform is | Select the device that can be used for configuring rules. | | AND User is accessing | Select the type of application the user should access. | | AND user matches | Select the login attributes that the user should match. | | THEN Use this Identity provider | Select the IdP to be used when all the conditions are met. | 5. Click **Create rule** and then indicate whether you want to activate the rule immediately. 6. To activate the rule, click **Activate**. ### Configuring Applications on 1Kosmos You can use one of the following methods to configure Okta applications with 1Kosmos. * Configuring Applications Using SAML 2.0 Generic * Configuring Applications Using Okta Integration (Prebuilt) #### Configuring Applications Using SAML 2.0 Generic To add new applications, follow these steps: 1. Log in to the 1Kosmos tenant as a community administrator. 2. Navigate to **Applications > Add Applications**. 3. In the **Saml 2.0 Generic** tile, click **Add Integration**. 4. In the wizard page that is displayed, click **Add Application**. 5. In the **Basic Settings** section, specify the application name, its URL and the instance to which the configuration is applicable, and then click **Next**. 6. In the **SAML Settings** section, navigate to the **Assertion Statement (NameID)** section, select the format of the nameid and its value, and then click **Next**. 7. In the **Advanced Options** section, specify the entity id and the Assertion Consumer Service (ACS) details; click **Save**. #### Configuring Applications Using Okta Integration (Prebuilt) To configure applications using Okta, follow these steps: 1. Log in to the 1Kosmos tenant as a community administrator. 2. Navigate to **Applications > Add Applications**. 3. In the **Pre-built integrations** section, click **Add integration** under the **Okta** tile. 4. In the Okta page that is displayed, enter the application name, service provider name, and the Okta Api token, and then click **Connect**. The added application is displayed on the home page of **Manage applications**. {% hint style="info" %} **Note:** You can use the **Okta API** token link located under the **Before we begin** section on the Okta page to generate a token. {% endhint %} ### Testing the Integration To test the integration, follow these steps: 1. Open the application URL. 2. You will be redirected to the 1Kosmos Login page. 3. Use the 1Kosmos app to scan the QR code. You will be redirected to the landing page of the Okta application. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.1kosmos.com/integrations/authentication/external-identity-provider-sso-federation/setting-up-1kosmos-as-an-identity-provider.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.