Okta SSO and Provisioning

Table of Contents

• Prerequisites
• Step 1. Navigate to the Okta Admin Console
• Step 2. Create the Custom Application
• Step 3. Configure the Application for the Generic SAML Integration
  • Configure Single Logout
  • Finish Creating the Application
  • Add User Name Attributes
  • Copy the Metadata URL
  • Assign Users and Groups
  • Complete the Integration in Bright
• Step 4. Automate Provisioning of Users and Groups with SCIM
  • Requirements
  • Enable SCIM Provisioning on the Custom Application
  • Configure Provisioning in Okta
  • Enable Provisioning Actions
  • Verify the Provisioning Attribute Mappings
  • Group Provisioning

Prerequisites

Before you begin, make sure you have:

1. Administrator access to your Okta organization.
2. Organization administrator permissions in Bright and the SSO feature enabled for your Bright subscription.
3. The Bright Service Provider (SP) details:
   • Entity ID
   • Assertion consumer service URL
   • Single logout service URL (optional)
     Collect these values from the SAML authentication page in Bright, as described in SAML SSO, Step 1.
4. Optional, for SCIM provisioning: a valid organization API key with the scim scope.

Step 1. Navigate to the Okta Admin Console

1. Log in to your Okta organization and click Admin in the upper-right corner. Alternatively, open the admin panel directly:

   https://<your-org>-admin.okta.com/

2. In the left pane, go to Applications > Applications.

Step 2. Create the Custom Application

1. Click Create App Integration.
2. In the Create a new app integration dialog:

   1. Select SAML 2.0 as the sign-in method.

   2. Click Next.

      

3. On the General Settings tab:

   1. In the App name field, enter a name for the application, such as Bright.

   2. Optionally, upload an app logo and configure the app visibility options.

   3. Click Next.

      

Step 3. Configure the Application for the Generic SAML Integration

On the Configure SAML tab, fill in the SAML settings using the Bright SP details collected from the SAML authentication page in Bright:

Configure Single Logout

This step is optional.

1. Click Show Advanced Settings.
2. Select Enable Single Logout.
3. In the Single Logout URL field, enter the Bright Single logout service URL.
4. In the SP Issuer field, enter the Bright Entity ID.
5. In the Signature Certificate field, upload the signing_certificate.cer file downloaded from the SAML authentication page in Bright.

Finish Creating the Application

1. Click Next.
2. On the Feedback tab, select This is an internal app that we have created.
3. Click Finish.

The custom application is created.

Add User Name Attributes

1. Open the Sign On tab of the application.
2. In the Attribute Statements section, click Add expression.
3. Add the following user name attributes:

These attribute names match the Bright defaults, so no custom attributes mapping is needed on the Bright side.

Note: In Okta organizations without the claims management feature, configure the attributes in the Attribute Statements section of the Configure SAML wizard instead. You can also use Show legacy configuration in the Attribute Statements section of the Sign On tab. In that case, use the Basic name format with the values user.firstName and user.lastName.

Copy the Metadata URL

In the Sign On tab, find the SAML Signing Certificates section and copy the Metadata URL.

Assign Users and Groups

In the Assignments tab, assign users and groups to the application. Assigned users will receive SSO access to the Bright app.

Complete the Integration in Bright

1. Open the SAML authentication page in Bright.
2. Select By metadata.
3. Paste the Metadata URL copied from Okta.
4. Finish the configuration as described in SAML SSO, Step 3.

Step 4. Automate Provisioning of Users and Groups with SCIM

You can configure SCIM provisioning in the custom application to automatically add Okta application users and groups to your organization in the Bright app. The added users will be able to access Bright using Okta SSO.

Bright supports the following attribute mappings for SCIM provisioning:

1. userName
2. email
3. emailType
4. displayName

Requirements

Before configuring SCIM, make sure:

1. The generic SAML integration is configured at the organization level, as described in Steps 1-3.
2. Provisioning is enabled on the Settings page in Bright by selecting Sync the groups & users from your SSO provider to Bright.
3. You have an organization API key with the scim scope.

Enable SCIM Provisioning on the Custom Application

Custom applications do not include the Provisioning tab by default. Enable it first:

1. Open the General tab of the application.
2. In the App Settings section, click Edit.
3. For the Provisioning option, select SCIM.
4. Click Save.

The Provisioning tab appears in the application.

Configure Provisioning in Okta

1. Open the Okta admin panel:

   https://<your-org>-admin.okta.com/

2. Go to Applications > Applications.

3. Select the generic SAML application created above.

4. Open the Provisioning tab.

5. Under Settings > Integration, click Edit.

6. In the SCIM connector base URL field, enter the URL for your Bright cluster:

   • Default cluster: https://app.brightsec.com/api/v1/scim/
   • EU cluster: https://eu.brightsec.com/api/v1/scim/
   • Other clusters: https://your-cluster-name.brightsec.com/api/v1/scim/

7. In the Unique identifier field for users field, enter userName.

8. Under Supported provisioning actions, select:

   • Import New Users and Profile Updates
   • Push New Users
   • Push Profile Updates
   • Push Groups
   • Import Groups

9. In the Authentication Mode dropdown, select HTTP Header.

10. Enter the organization API key with the scim scope as the Authorization bearer token.

11. Click Test Connector Configuration and verify that the test succeeds.
12. Click Save.

The To App entry appears in the Settings section of the Provisioning tab.

Enable Provisioning Actions

1. Under Settings > To App, click Edit.
2. Enable:
   • Create Users
   • Update User Attributes
   • Deactivate Users
3. Click Save.

Verify the Provisioning Attribute Mappings

After a successful connector test, Okta creates the application user profile with the default attribute mappings already configured. No manual mapping is required.

To verify the mappings:

1. Under Settings > To App in the Provisioning tab, scroll to Attribute Mappings.
2. Confirm that the attributes supported by Bright are mapped as follows:

Group Provisioning

Group provisioning from Okta to Bright must be enabled by pushing each group manually:

1. Assign the group you want to push to the custom application.
2. In the Push Groups tab, click Push Groups.
3. Select the group you want to push to your Bright organization.
4. Click Save.

Synchronized users are added to the Members section, and synchronized groups are added to the Groups section of your Bright organization.

Note: If you deprovision a user from the custom application in Okta, the corresponding member becomes inactive in your Bright organization and can no longer log in to Bright using SSO.