SSO Setup: OKTA Configuration for ConveyIQ

This topic provides the steps required to configure Okta SSO and Provisioning for ConveyIQ. It includes the following sections:

• Features
• Requirements
• Configuration Steps

Features

The following provisioning features are supported:

The following SSO features are supported:

Requirements

Connecting ConveyIQ to Okta requires configuring two applications in the Okta Administration Console. The first application is manually configured and uses OpenID Connect to authenticate users to the ConveyIQ service. The second application is available as ConveyIQ SCIM Provisioning in the Okta Integration Network (OIN). After the applications are created, they need to be assigned to a User Group in Okta. Once all is set, the last step is to Configure the OpenID Connector by submitting credentials through a self-service flow provided by ConveyIQ.

Configuration Steps

The following steps need to be completed to enable Okta SSO and Provisioning with ConveyIQ:

• Create OpenID Connect ConveyIQ Application in the Okta Administrative Console
• Add the ConveyIQ SCIM Provisioning Application in the Okta Integration Network
• Configure the OpenID Connector in the ConveyIQ Application
• Create ConveyIQ Group in Okta

Step1: Create the OpenID Connect ConveyIQ Application in the Okta Administrative Console

1. Sign in to the Okta Administration Dashboard, then choose Add Application.
2. In the Create New Application dialog box choose OpenID Connect and click Create.
3. Name the application ConveyIQ by Entelo.
4. Uploading of the logo is optional, reach out to Entelo support for the image, if not already provided.
5. In the Login redirect, URIs field enter: https://identity-provider.na.conveyiq.com/session/oidc/authorization_code
6. In the Logout redirect, URIs field enter:https://identity-provider.na.conveyiq.com/session/sign_in
7. Click Save.
8. Keep the General Setting tab open and click Edit.
9. Under the Allowed grant types section select these three checkboxes:
   • Authorization Code
   • Refresh Token
   • Implicit (Hybrid) *Leave Allow ID token with implicit grant type option checked**
10. Under the Login Initiated by section select the Either Okta or App option.
11. Under the Application Visibility section, select these checkboxes:
    • Display application icon to users
    • Display application icon in the Okta Mobile App
12. In the Initiate login, URI field enter:https://identity-provider.na.conveyiq.com/session/sign_in
13. Click Save.

Note: Leave the page open because you will need the Client ID and Client Secret for step 2 below.

Step 2: Configure the OpenID Connector in the ConveyIQ Application

1. In coordination with your Entelo Customer Success Manager, you should have received an email with subject ConveyIQ - OpenID Connect Configuration.

   Note: If you have not received an email yet, contact your Entelo Customer Success Manager contact or support team.

2. In the email click the link Configuration URL.
3. On the Configuration step enter the:
   • Domain
   • Client ID
   • Client Secret

     Note: The Domain is your Okta Domain for example if your Okta URL is "https://acme.okta.com/" then your domain is "acme.okta.com". The Client ID and Secret can be found on the General Settings of the ConveyIQ by Entelo application created in step 1.

4. Click Update.

Step 3: Add the ConveyIQ SCIM Provisioning Application in the Okta Integration Network

1. In the Okta Administration Console choose Applications.
2. Click Add Application.
3. Search for "ConveyIQ by Entelo"
4. Click Add.
5. In the General Settings step under the Application Visibility make sure to check the following checkboxes:
   • Do not display the application icon to users
   • Do not display the application icon in the Okta Mobile App
6. f. Click Done.
7. On the Provisioningtab click Configure API Integration.
8. Select Enable API Integrationf. Click Done.
9. In the Base URL field paste this URL: https://identity-provider.na.conveyiq.com/scim/v2
10. In the Username field paste the Client ID from the OpenID Connect application from step 1.n above.
11. In the Password field paste the Client Secret the OpenID Connect application from step 1.n above.
12. Click Test API Credentials
13. If the test result is positive, click Save.
14. Make sure after page reload that you are still on the Provisioning Tab > Setting > To App section
15. Click Edit next to 'Provisioning to App'
16. Check the Enable check boxes for:
    • Create Users
    • Update User Attributes
    • Deactivate Users
17. Click Save.

Step 4: Create ConveyIQ Group in Okta

1. In the Okta Administration Console choose DirectoryGroups.
2. Click Add Group.
3. Enter Group Name (example): ConveyIQ.
4. Enter Group Description (example): Users assigned to ConveyIQ.
5. Click Add Group.
6. Click the Group to open the group details.
7. Click Manage Apps.
8. Assign the ConveyIQ SCIM Provisioning application.
9. Skip the Extra Info and click Save and Go Back.
10. Assign the ConveyIQ by Entelo application.
11. Click Done.
12. Click Manage People.
13. Add all the desired members that you wish to grant access to ConveyIQ.
14. Click Save.

At this point, all should be configured and the following is expected to work: All the people added to the ConveyIQ Group should be imported as users to the ConveyIQ application and able to sign in. In Okta, the same users should be able to see the "ConveyIQ by Entelo" application under ‘My Apps’ and use it for SSO. The next steps are to assign permissions to the imported users in the ConveyIQ application.