Logging in to Elvis using single sign-on (SSO) via Okta is one of the ways of logging in to Elvis using SSO.
This article describes how to implement Okta in Elvis 6.
Note: The images and steps in this article are those from the Classic UI. When logged in to Okta with a developer account, the Admin UI is shown which differs in places from the Classic UI. It is advised to switch to the Classic UI to correctly follow the steps.
Using Okta in Elvis 6 requires the following:
- Elvis 6.36 or higher
- When using Elvis in InDesign: the Elvis InDesign client 3.6 or higher
Before you start
Before you start, make sure that:
- The Elvis Server environment in which Okta is implemented has a fully working Elvis server and fully working client applications.
Notes about setting up users and user groups in Elvis Server:
- When implemented, disable SAML and/or LDAP.
- You have access to Okta and you have sufficient access rights to configure Okta
- Okta is set up to your needs, for example by setting up additional security rules.
The implementation consists of the following steps:
In Okta, Elvis needs to be set up as an application and linked to users or user groups.
Step 1. In Okta, navigate to Applications and click Add Application.
Step 2. Click Create New App and set the following options:
- Platform: Native app
- Sign on method: OpenID Connect
Step 3. Click Create and set the following options:
- Application name. A descriptive name for the app.
- Login redirect URIs. Enter the <base URL> + /openid/callback:
Note: The base URL is the exact URL for Elvis as shown in the Web browser.
Step 4. Click Save.
You are returned to the previous screen.
Step 5. In the Client Credentials section, click Edit and set the following option:
- Client authentication: 'Use Client Authentication'
Step 6. Click Save.
Step 7. Copy the Client secret and paste it in a text file. It is needed later when configuring Elvis Server.
Step 8. Scroll to the top of the page and click the Sign On tab.
Step 9. In the OpenID Connect ID section, click Edit and set the following option:
- Groups claim filter: Configure the filter to your needs.
Step 10. Click Save.
Step 11. Scroll to the top of the page and click the Assignments tab.
Here, the applications need to be tied to users or user groups.
Step 12. Search for users or groups and assign them to the application.
In Elvis Server, a connection to the Elvis application in Okta needs to be configured.
Step 1. In the Management Console, access the Single sign-on page.
Step 2. Fill in all fields.
Test the implementation by logging in to Elvis using the various applications:
- The Pro client
- The Brand portal
- The Management Console
- Elvis in InDesign
Test the scenario where the user is not yet logged in to Okta and where the user is already logged in to Okta. Follow the steps on screen.
- 1 October 2019: Updated the introduction by adding a note about the Classic UI and the Admin UI.