Configuring Single Sign-On (SSO) using SAML 2.0 for Okta
(Feature available only in Enterprise Edition)

ManageEngine Password Manager Pro offers support for SAML 2.0, which facilitates integration with Federated Identity Management Solutions for Single Sign-On. Password Manager Pro acts as the Service Provider (SP) and it integrates with Identity Providers (IdP) using SAML 2.0. The integration basically involves supplying details about SP to IdP and vice-versa. ​Once you integrate Password Manager Pro with an IdP, the users have to just login to IdP and then, they can automatically login to Password Manager Pro from the respective identity provider's GUI without having to provide credentials again. ​Password Manager Pro supports out-of-the-box integration with Okta.

Note: Password Manager Pro allows users to configure SAML SSO for Secondary server as a service provider, which allows users to log in to Password Manager Pro using the Secondary server when Primary is down.

Steps Required

Integrating Password Manager Pro with Okta involves the following four steps:

1. Adding Password Manager Pro as an application on the Okta dashboard

  1. Log in to your Okta Admin account and click Applications tab.

  2. In the new page that opens up, select Add Application.

  3. As shown in the image below, click on Create New App.

  4. Immediately, a window will pop-up asking information about the type of application integration. Choose SAML 2.0 and click Create.

  5. Enter the name of the app being added (ME Password Manager Pro) as prompted under General Settings. You can also optionally choose to upload a logo for the app. When you are done, click on Next.

  6. The second step in configuring SAML integration consists of providing details about the Service Provider (ME PMP) to Okta.
    1. To access these details, go to Password Manager Pro Homepage and select ​Admin >> SAML Single Sign On.
    2. Under 1. Service Provider Details, you will find Entity Id, Assertion Consumer URL and Single Sign On URL; copy the values.

    Note:

    For SAML SSO authentication, the Assertion Consumer URL is the hostname of the server, by default. To update the Assertion URL, follow the below steps:

    1. Go to Admin >> Settings >> Mail Server Settings.
    2. Under Access URL, update the required URL and click Save.

    Now, the Assertion Consumer URL under Service Provider Details will be updated.

  7. Go back to Okta's SAML Settings page.
  8. For MSP, enter Assertion Consumer URL from Password Manager Pro under Single sign on URL and select the checkbox Use this for Recipient URL and Destination URL.

  9. For Client Organizations, enter Single Sign On URL from Password Manager Pro under Single sign on URL.
    1. Deselect the checkbox Use this for Recipient URL and Destination URL and mention the Assertion Consumer URL from Password Manager Pro under Recipient URL and Destination URL.

  10. Mention the Entity Id from Password Manager Pro under Audience URI (SP Entity ID).
  11. After filling-in the Single Sign On URL and Audience URI (SP Entity ID) fields, you need to specify how you want Okta to recognize the names of your users in Password Manager Pro. Since the way in which the usernames are displayed in Okta is different from how they are depicted in Password Manager Pro, you have to specify the format. There are two scenarios here:
    1. Scenario 1: If you have imported users from AD into Password Manager Pro, they would have been imported in the format Domain\Username. For more help on integrating Okta with your on-premise AD, please check the help documentation of Okta available here. In Okta GUI, you need to choose the option Custom from the drop-down Name ID format. Then, you should specify the custom format as given below:

      2. toUpperCase(substringBefore( substringAfter(user.email, "@"), ".")) + "\" + substringBefore( user.email, "@")

    2. Scenario 2: If you have not used AD integration in Password Manager Pro, you should select the option Okta Username Prefix. This is because in Okta, user profiling is done in the format username@domain.com. But, in Password Manager Pro, user names are depicted only as usernames.

      3. ​​This step is crucial because, only if you specify the correct Name ID format in Okta, you will be able to assign the application (Password Manager Pro) to other users in Okta.

  12. To configure SAML Single Logout, click Show Advanced Settings.
    1. Select Allow application to initiate Single Logout checkbox to Enable Single Logout.
    2. Mention the Single Logout Service URL from Password Manager Pro under Single Logout URL.
    3. Enter the Entity Id from Password Manager Pro under SP issuer.
    4. Click Browse to upload the Password Manager Pro certificate under Signature Certificate.

      Notes:

      1. SAML Single Logout is applicable from  build 12100 and above only.
      2. To download Password Manager Pro certificate, navigate to Admin >> Authentication >> SAML Single Sign-On (Step 1) and Download SP Certificate File.

  13. Once you have filled in the required details as mentioned above, click Finish to add the application. On addition, the application details will be displayed as shown in the image below. Click on Sign On and then select View Setup instructions. A new tab will open ​containing the details required to configure SAML 2.0 in Password Manager Pro, which is discussed in the next step.

2. Configuring Okta details in Password Manager Pro

You need to configure IdP details in Password Manager Pro. This is done as part of the second step, Configure Identity Provider Details in Password Manager Pro's SAML Single Sign On page. Here, you have the option either to enter the details manually or auto-fill the same by supplying the metadata file from the IdP.

    1. Manual Set-up: If ​you choose to fill the details manually, get the IdP details such as Issuer ID, Login URL, and Logout URL from the Setup Instructions page of Okta. Configure the same in the step 2 given in Password Manager Pro SAML Sign On configuration page. Enter the details in the corresponding fields and also download the Okta certificate and upload onto the Password Manager Pro client (Listed as the 3rd step in the Password Manager Pro GUI). Alternatively, you can also save the certificate file in the Password Manager Pro File Store or Key Store and then use it here.
    2. Auto-Filling with IdP Metadata File: Scroll down on the SAML 2.0 setup instructions page of Okta and you will find the IdP metadata under Optional. Copy the text and ​save in a file with .xml extension. Now, upload the same .xml file onto the Password Manager Pro client. ​In this case, you needn't import IdP certificate in Password Manager Pro. It will be updated automatically.

3. Assigning Application to Users in Okta

After completing the configurations in Password Manager Pro, go back to Okta to assign the newly added application to your users. Navigate to Applications >> Assign Applications and select the Password Manager Pro app. Under People, select the desired users and confirm assignments.

4. Enabling SAML Sign On in Password Manager Pro

The final step of this configuration ​is enabling SAML Single Sign On in Password Manager Pro. This would be shown as the 4th step in the SAML page in Password Manager Pro GUI. Click Enable shown at the bottom right to ​begin using this feature.

    Note: It is not possible to configure SAML SSO in Password Manager Pro logins enabled with AD authentication. To disable AD authentication, go to Admin >> Active Directory.
Top