Configuring Okta as an identity provider
You can use Okta as an identity provider to access SC//Nexus™. To do this, you create a SAML app integration on the Okta platform and then hand the Okta metadata back to Scale Computing.
SC//Nexus service provider details
SC//Nexus publishes the following service provider details for your identity provider. The steps on this page show which of them Okta uses and where to enter them.
| Detail | Value |
|---|---|
| SC//Nexus™ portal service provider metadata (XML) | https://nexus.scalecomputing.com/api/v1/saml/metadata |
| Assertion Consumer Service (ACS) URL | https://nexus.scalecomputing.com/sso/api/oauth/saml |
| Entity ID / Audience URI | https://saml.stargate.local |
| Signing Certificate | https://nexus.scalecomputing.com/sso/.well-known/saml.cer |
Step 1: Create the Okta SAML app integration
The Okta documentation provides the steps for creating a SAML app integration on their platform. For more information, see Create SAML app integrations in the Okta documentation.
- Access and log in to your Okta Admin Dashboard.
- From the left navigation, choose Applications, Applications.
- Choose Create New App.
- From the Create a new app integration pop-up, choose SAML 2.0, Next.
-
On the Create SAML Integration page, do the following.
-
On the General Settings step, for App name, specify
SC//Nexusand then choose Next.
-
On the General Settings step, for App name, specify
On the Configure SAML step, use the following settings. Choose Show Advanced Settings to see the complete list.
| Setting | Value |
|---|---|
| Single sign-on URL | https://nexus.scalecomputing.com/sso/api/oauth/saml |
| Audience URI (SP Entity ID) | https://saml.stargate.local |
| Default RelayState | blank |
| Name ID format | EmailAddress |
| Application username | |
| Update application username on | Create and update |
| Response | Not signed |
| Assertion Signature | Signed |
| Signature Algorithm | RSA-SHA256 |
| Digest Algorithm | SHA256 |
| Assertion Encryption | Unencrypted |
| Single Logout | Disabled |
SC//Nexus requires the assertion to be signed but does not require the response to be signed, and publishes no single logout endpoint. This differs from the SC//Reliant™ Platform Manager integration, which signs both.
Step 2: Retrieve the Okta identity provider metadata
Once your Okta SAML app integration exists, retrieve the Okta identity provider metadata and provide it to your Scale Computing account manager or Support to complete the setup.
- In the Okta Admin console, access the settings for the SC//Nexus application you created.
- On the Sign On tab, locate the SAML Signing Certificates section.
- From the Actions menu of the signing certificate, choose View IdP metadata. Make sure you do this with the Active certificate.
- Copy that metadata and provide it to your Scale Computing account manager or Support, who adds it to your SC//Nexus organization.
Step 3: Create and assign people to the SAML application
To complete the authentication workflow, create user accounts in Okta, referred to as People in the Okta Dashboard, for each SC//Nexus user and assign them to your Okta SC//Nexus application. For more information, see User management in the Okta documentation.
IMPORTANT: Ensure that the Username field in Okta matches the user's SC//Nexus account email address, in all lowercase.
For more information on assigning users to an application, see Assign applications to users in the Okta documentation.
Troubleshooting login issues when using Okta as an identity provider
Issue: Receiving an "Invalid Email or password" error when logging in to SC//Nexus
Possible causes: Ensure the Okta username is the same as the email address on the SC//Nexus account, including case, so make sure the email address is all lowercase in the Okta application. To transform the Okta username to lowercase, use the toLowerCase(user.email) syntax to override the format. For more information, see Override a username format in the Okta documentation.