This section describes how to integrate RSA Cloud Authentication Service with Okta using SAML Relying Party.

Configure RSA Cloud Authentication Service

Perform these steps to configure RSA Cloud Authentication Service

Procedure

1. Sign in to RSA Cloud Administration Console.
2. Navigate to Authentication Clients menu and select Relying Parties.

3. In the Relying Party Catalog, select Add a Relying Party and click Add for Service Provider SAML.

4. On the Basic Information page, enter the name for the application in the Name field and click Next Step.

5. In the Authentication tab, select SecurID manages all authentication, Select a Primary Authentication Method and Access Policy as required and click Next Step.

6. Under Data Input Method, click Import Metadata file from Okta to populate the Assertion Consumer Service URL value and Service Provider Entity ID.

7. Under the Message Protection section, for SAML Response Protection:

• • Select IdP signs assertion with response.

8. Scroll down to the User Identity section and select the following:
   1. Identifier Type – emailAddress
   2. Property – mail

9. Identity Provider, same Entity ID is required to configure in the Okta configuration.

10. Click Save and Finish.
11. On the My Relying Parties page, click Edit Dropdown and select Metadata option to download the metadata.
12. Click Publish Changes. After publishing, your application is now enabled for SSO.

The Configuration is complete.

OKTA Configuration

Perform these steps to configure OKTA.

Procedure

1. Log in to Okta with the admin account, browse to the Security > Identity Providers  > Add Identity Provider.

2. Select the Identity Provider as SAML 2.0 click on next.

3. Provide the name details to configure General settings.

4. Select IdP Usage as SSO only and select the checkbox for Account matching with Persistent Name ID.

5. Provide details in the Account matching with IdP Username section.

1. • Select the idpuser.subjectNameID from drop down for IDP username.
   • Match against field select the Email from drop down.
   • If no match is found select the check box Redirec to Okta Sign-in page.

6. Provide the following details in the SAML Protocol Setting section:

• • IdP Issuer URI - Obtain from the metadata file downloaded from RSA.
  • IdP Single Sign-On URL - Obtain from the metadata file downloaded from RSA.
  • IdP Signature Certificate – Upload the downloaded certificate from RSA.
  • Request Binding – Select HTTP POST.

7. Provide the details as shown in the following figure and click Finish.

• • Request Signature select the check box Sign SAML Authentication requests.
  • Request Signature Algorithm select the SHA-256 from the drop down list.
  • Destination Specify the destination RSA URL.

     8. Navigate to the Identity Providers section and click Add Routing Rule under the Routing rules tab.

    9. Provide the Rule name, select the IdP as Okta under IdPs, and click Create rule.

The configuration is complete.