Okta Identity Provider Configuration

^{Last Updated: 2025-04-10}

Purpose

This document provides instructions to set up and configure Okta Identity provider (IdP) for OUTSCAN or HIAB using Security Assertion Markup Language (SAML) protocol.

Introduction

Okta is a Identity and Access Management (IAM) solution that add authentication service to applications across a wide variety of platforms using Single Sign-On (SSO) authentication scheme. Okta allows connections to any application and define how users sign in. When a user tries to authenticate, Okta verifies their identity and send the required information back to the application from which the login was initiated (Application initiated authentication).

Okta Configuration

This section describes the steps to configure Okta (IdP) by creating an application in order to integrate with OUTSCAN or HIAB solution.

Create an application

To create an application:

1. Login to Okta portal with administrative privileges and then navigate to Applications/Applications in the left menu as shown below:
   
   

   

   
   
   

2. Then click the Create App Integration button that will open a window to create a SAML application integration.
   

   

   
   
   

3. Select SAML 2.0 and then click the Next button. This open a new window to create the application.

4. Name the application and provide a logo and click on the Next button.
   

   

   
   
   

5. Once the general settings are entered, continue to the SAML configuration step where you need to add OUTSCAN or HIAB URL. Adjust both Single sign on URL and Audience URI (SP Entity ID) by replacing <OUTSCAN/HIAB_FQDN_OR_IP> with the FQDN or IP address of your OUTSCAN or HIAB setup in the following text:

• Single sign on URL

• Audience URI (SP Entity ID)

6. Your configuration should then look as follow:

7. To allow the OUSTCAN or HIAB application to properly identify the Identity during the authentication phase, you need to declare the same attribute in both OUTSCAN or HIAB and the identity Provider (IdP). In Okta, this can be done by adding an attribute as shown below.
   

   

8. Once done, you can preview the SAML assertion and then click the Next button.
   

   

   
   

9. After answering Okta Support question, click the Finish button to create the application.
   

   

   
   

10. Once you have created the OUTSCAN or HIAB application on Okta Identity Provider, you need to assign users or groups to this application. In our example below we are using a group that makes management easier.
    Open the Assignments tab and click on the Assign button.
    
    

11. Select Assign to Groups to start assigning groups to the application.
    

    

    
    
    

12. Choose a group to assign and click on the blue Assign text.
    

    

    
    
    

13. When the users or groups has been assigned to the application, click the blue Done button.
    

    

    
    
    

14. Your assignment is now populated.

OUTSCAN or HIAB Configuration

To configure OUTSCAN/HIAB to use OneLogin as identity provider, you need to achieve the following steps:

• Retrieving the metadata file describing the identity provider

• Adjust the metadata file (if needed)

• Uploading the metadata file in OUTSCAN/HIAB

Retrieve Identity Provider Metadata file

To retrieve the IdP metadata file, you need to open the Sign On tabulation of your application.

Then scroll down to the SAML Signing Certificates section and then click on the Actions button menu to View the IdP metadata.

This opens a new page in your browser that you can save on your computer and reuse later while configure the IdP in OUTSCAN or HIAB software.

Adjust Identity Provider Metadata File

To integrate an Identity Provider (IdP) in OUTSCAN or HIAB, you have to upload the SAML Metadata file describing the IdP. This file must comply to the SAML standard.

Upload the SAML Metadata File

Open the SAML Metadata file retrieved from the Identity Provider (IdP) and make sure that:

• The file contains the XML tag: <?xml version='1.0' encoding='UTF-8'?>

• The EntityDescriptor section contains validUntil attribute

A valid SAML Metadata file should looks like the following

Setting Up Identity Provider

When setting up a SSO for a sub-user, the UID must be the same as the e-mail address.

Test the Integration

SP initiated SSO, for example from Outpost24 

1. Go to https://outscan.outpost24.com. (or alternatively go to your HIAB https://<hiab-ip-address> if you integrate Okat with HIAB)

2. Enter your username.

3. Click on Single Sign-On.

4. Enter your username and password on the Okta page you have been redirected to.

5. Click Sign In.

6. You will be redirected to OUTSCAN and authenticated.

   
   

IdP initiated SSO, for example from Okta

1. Login to okta <YourDomain>.okta.com.

2. Click on <Outscan/Hiab> to be redirected to Outpost24 OUTSCAN/HIAB

3. You are redirected to either NetSec or Portal UI depending on the settings you set in NetSec UI Identity provider integration window.

Reference

Okta SAML concepts overview: https://developer.okta.com/docs/concepts/saml/

Okta SAML integration: https://developer.okta.com/docs/guides/build-sso-integration/saml2/main/