Okta as SAML Identity Provider

1. Setup App Integration in Okta

1.1. Prerequisites

Login to your Turbomechanica account with user email provided by Mechademy.
On the Turbomechanica dashboard, in the left panel click on Settings Icon > Integrations > Click on info icon on the top right corner > Select integration type as Okta Saml
Note the identity provider Single Sign-On URL and Audience URI (SP Entity ID) ; these will be used in later steps to create app integration.

1.2. Create App Integration

Log in to the Okta Developer Console, go to Okta Admin Dashboard.
Go to Applications > Applications > Create App Integration and choose SAML 2.0 from the options.
Click Next.
Provide the general information for the integration and then click Next.
Provide the necessary SAML settings information for your integration. (See Application Integration Wizard SAML field reference for descriptions of individual fields.)

Configure the following settings:

Setting	Description	Example
Single Sign-On URL	To obtain the value, please follow instructions in 1.1 prerequisites section above.	https://{yourAuthDomain}/login/callback?connection={yourAuthConnectionName}
Audience URI (SP Entity ID)	To obtain the value, please follow instructions in 1.1 prerequisites section above.	urn:auth0:{yourAuthTenantName}:{yourAuthConnectionName}

Select Use this for Recipient URL and Destination URL

In Attribute Statements section, add following attributes :

Name	Name format	Value
firstName	Unspecified	user.firstName
lastName	Unspecified	user.lastName
email	Unspecified	user.email

Optional. Click <> Preview the SAML Assertion to view the XML generated from the SAML settings that you provided.
Click Next.
Provide configuration information about your app integration to Okta:

Select I'm an Okta customer adding an internal app.
Select This is an internal app that we have created.

Click Finish. Your integration is now created in your Okta account.
After you create your SAML app integration, the SAML Signing Certificates section appears on the Sign On tab.
Go to Sign On tab, in Saml 2.0 section click on more details and note the Identity Provider Single Sign-On URL, click on Download to obtain a copy of the currently active X.509 certificate.

2. Setup SAML Integration in Turbomechanica.

Login to your Turbomechanica account with user email provided by Mechademy.
On the Turbomechanica dashboard, in the left panel click on Settings Icon > Integrations > Click on Add Integration on the top right corner.
Follow the steps and provide the following mandatory configuration settings for this connection:

Field	Description
Integration Name	Integration Name.
Sign In URL	To obtain the value, please follow instructions in Step 12 of 1.2 Create App Integration section above.
X509 Signing Certificate	To obtain the value, please follow instructions in Step 12 of 1.2 Create App Integration section above.
Domain Aliases	Your company's domain address used in email IDs. This user's email domain will be compared to this value. If there is a match, users will be redirected to the identity provider.

Click Save. Your integration is completed. Well Done !

3. Test the Integration

To test the user login process, create a test user with your company's email domain (email domain should match with value added in Domain Aliases in above section) in your Okta account.

Log in to the Okta Developer Console, go to Okta Admin Dashboard.
Go to Directory > People
Click the Add Person button.
Fill in User Details
Activate User

Assign test user with permissions to access the newly created app.
Go to your Turbomechanica domain. This time, try logging in with Okta credentials for test user and you should be redirected to OKTA SSO page for login.

Note: If you face any issues regarding redirection, make sure to check your email address domain matches with Domain Alias field added in previous steps.

4. Assign Users to App

Log in to the Okta Developer Console, go to Okta Admin Dashboard.
Go to Applications > Applications > Click Assign Users to App.
Select the app created in the above steps and assign it to people or groups.
Click Next and Confirm Assignments.

Request Template

<samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
@@AssertServiceURLAndDestination@@
    ID="@@ID@@"
    IssueInstant="@@IssueInstant@@"
    ProtocolBinding="@@ProtocolBinding@@" Version="2.0">
    <saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">@@Issuer@@</saml:Issuer>
</samlp:AuthnRequest>

IdP-initiated SSO

Reference: Configure Okta as SAML Identity Provider

Turbomechanica Docs