Okta SSO

SureMDM's seamless integration with Okta Single Sign-On (SSO) provides your organization with a streamlined and secure authentication experience. With Okta SSO, you can leverage a centralized identity management solution that enhances user convenience and bolsters data protection. Users can access SureMDM and other connected applications using a single set of login credentials. This eliminates the need to remember multiple passwords and simplifies the login process.

There are two ways to configure Okta SSO in SureMDM:

Configuration	Select Identity Provider (IdP)	How permissions are assigned
Standard Okta SSO	Okta	The same Role, Device Group Set and Jobs/Profiles Folder Set apply to every user who signs in through Okta.
Dynamic Permission Assignment	Generic	Permissions are assigned per user, based on the Okta groups the user is a member of, sent as a SAML attribute.

IMPORTANT

Currently Dynamic Permission Assignment is available only with the Generic option. If you select Okta in the Select Identity Provider (IdP) drop-down, Static permissions can be assigned.

Prerequisites

• An Okta account with admin access to the Okta Admin Console.
• A SureMDM account with permission to change Account Settings.
• Your SureMDM server path.
• For Dynamic Permission Assignment setting up Attribute Statements by Adding Expressions is required.

Step 1: Create the app integration in Okta

1. Log in to the Okta Admin Console.
2. Navigate to Applications and resources > Applications and click Create App Integration.
3. Select SAML 2.0 and click Next.
4. On the General Settings tab, enter an App name and click Next.
5. On the Configure SAML tab, enter the following values:

Field	Value
Single sign-on URL	https://<SureMDM Server Path>/console/ssoconsumer/<Encrypted Account ID>
Audience URI (SP Entity ID)	urn:42gears:suremdm:SAML2ServiceProvider

note

The Encrypted Account ID is generated by SureMDM only after the SAML Single Sign-On settings are saved (Step 2). For now, enter a placeholder value for the Encrypted Account ID so that Okta lets you save the app. You will replace it with the actual URL in Step 3.

6. You can either update attribute statements now or leave the Attribute Statements section in the wizard empty, it can be added later as well from the Sign On tab (please refer to the section Add attribute statements in Okta).
7. Click Next. and then click Finish.
8. On the app's Sign On tab, click View SAML setup instructions and copy the following values:
   • Identity Provider Single Sign-On URL
   • Identity Provider Issuer
   • Identity Provider Single Logout URL (if available)
9. Download the X.509 Certificate (.cer file).
10. Navigate to the Assignments tab and assign the users or groups who should sign in to SureMDM through Okta SSO.

Verification: The app is saved in Okta, you have copied the Identity values, and you have downloaded the .cer certificate.

Step 2: Configure SAML Single Sign-On in the SureMDM console

Use this procedure for standard Okta SSO, where all Okta users get the same permissions. For Dynamic Permissions Assignment please skip to the Dynamic Permission Assignment section.

1. Log in to the SureMDM Web Console.
2. Navigate to Settings (gear icon at the top right) > Account Settings > Enterprise Integrations > SAML Single Sign-On.
3. Click Add.
4. Configure the following settings:

Setting	Description
Select Identity Provider (IdP)	Select Okta.
Service Identifier	Paste the Identity Provider Issuer copied from Okta.
Sign On Service Url	Paste the Identity Provider Single Sign-On URL copied from Okta.
Logout Service Url	Paste the Identity Provider Single Logout URL copied from Okta.
Upload Certificate	Upload the .cer certificate downloaded from Okta. Leave the password field empty.
Roles	Select the role to assign to the users. See Configure Permissions for Role-Based Admin.
Device Group Set	Select the device group set to assign to the users. See Configure Permissions for Device Group Set Based Admin.
Jobs/Profiles Folder Set	Select the jobs/profiles folder set to assign to the users . See Configure Permissions for Job Folder Set Based Admin.
Remote File Manager Access Control	Select the Remote File Manager access control to assign to the users . See Configure Permissions for Job Folder Set Based Admin.

5. Click Save.
6. On the SAML Single Sign-On screen, locate the Assertion URL column for the saved configuration and copy the full URL. It contains your Encrypted Account ID and has this format: https://<SureMDM Server Path>/console/ssoconsumer/<Encrypted Account ID>

Step 3: Update Okta with the Assertion URL

1. Return to the Okta Admin Console and navigate to Applications and resources > Applications.
2. Select the app created in Step 1.
3. On the General tab, under SAML Settings, click Edit.
4. Click Next to open the Configure SAML tab.
5. In Single sign-on URL, replace the placeholder with the exact Assertion URL copied from SureMDM: https://<SureMDM Server Path>/console/ssoconsumer/<Encrypted Account ID>
6. Click Next, then click Finish.

Add attribute statements in Okta

Attribute statements specify which user attributes Okta includes in the SAML assertion it sends to SureMDM during sign-in. They are required for Dynamic Permission Assignment.

Please refer to https://help.okta.com/en-us/content/topics/apps/federated-claims-overview.htm on how to set up custom claims.

DISCLAIMER

The third-party configuration steps in this article are based on the vendor's documentation available at the time of publication and may change. Always refer to the official vendor documentation for the latest instructions.

The steps are the same for an existing app and a new app

1. In the Okta Admin Console, navigate to Applications > Applications and open the SureMDM app.
2. Select the Sign On tab.
3. Scroll down to the Attribute statements section and click Add expression.

Sample Okta Expressions

Use these expressions in the Value field of each Okta attribute statement. The group names mentioned are examples. Please replace them with your own Okta group names if needed.

Use case	Name	Expression
User's email	email	user.profile.email
User's first name	firstName	user.profile.firstName
User's last name	lastName	user.profile.lastName
One specific group	Groups	user.getGroups({'group.profile.name': 'Test Group'}).![profile.name]
Several specific groups	Groups	user.getGroups({'group.profile.name': {'First Group', 'Second Group', 'Third Group'}}).![profile.name]

Dynamic Permission Assignment

Dynamic Permission Assignment lets you assign different permissions to users based on the attributes Okta sends in the SAML assertion. You can use any attribute that has an attribute statement configured in Okta, such as Groups or Name. When a user signs in, SureMDM checks the attribute values against your Dynamic Permission Assignment rules and assigns the matching permissions.

IMPORTANT

To use Dynamic Permission Assignment with Okta, you must select Generic in the Select Identity Provider (IdP) drop-down.

Configure Okta

1. Complete Step 1: Create the app integration in Okta.
2. Refer Add attribute statements in Okta to Add Expressions

Configure SureMDM

1. Log in to the SureMDM Web Console.
2. Navigate to Settings (gear icon) > Account Settings > Enterprise Integrations > SAML Single Sign-On.
3. Click Add.
4. Configure the following settings:

Setting	Description
Select Identity Provider (IdP)	Select Generic.
Service Identifier	Paste the Identity Provider Issuer copied from Okta.
Sign On Service Url	Paste the Identity Provider Single Sign-On URL copied from Okta.
Logout Service Url	Paste the Identity Provider Single Logout URL copied from Okta.
Upload Certificate	Upload the .cer certificate downloaded from Okta. Leave the password field empty.

5. Click on the Dynamic Permission Assignment tab and click Add.
6. In Attribute, enter the name of the attribute statement you added in Okta (for example, Groups or firstName).
7. Select the condition and in Value, enter the value to match for that attribute.
8. Select the Role, Device Group Set and Jobs/Profiles Folder Set, Remote File Manager Access Control to assign to users whose attribute matches that value.
9. Click Save.

note

Okta Expression Language is maintained by Okta. For assistance on expressions or custom claims, please reach out to Okta support.