This article describes how to integrate RSA Cloud Access Service (CAS) with Okta using SAML My Page SSO.

Configure CAS

Perform these steps to configure CAS using My Page SSO.

Procedure

1. Sign in to the RSA Cloud Administration Console and browse to Applications > Application Catalog.

2. Click Create from Template, and then click Select next to SAML Direct.

3. On the Basic Information page, choose Cloud.

4. Enter the name for the application and click Next Step.

   

5. On the Connection Profile page, navigate to the Initiate SAML Workflow section and choose IdP-initiated.

6. Under Data Input Method, choose Enter Manually.

   Note: The fields in the next step are temporary and are required to complete the application and export the IdP metadata. After configuring Okta, update this configuration using the metadata downloaded from Okta.

7. Scroll down to the Service Provider section and enter the following:

   • Assertion Consumer Service (ACS) URL: Enter any valid URL. This URL will be updated automatically when you upload the Okta metadata.
   • Service Provider Entity ID: Leave the default value. This value will be updated automatically when you upload the Okta metadata.

   

8. Make a note of the Identity Provider URL. This URL will be used later in the Okta configuration.

9. In the Message Protection section, choose IdP signs assertion within response.

10. Click Download Certificate. This certificate will be used later in the Okta configuration.

    

11. Expand Connection Profile Advanced Configuration.

12. Under the User Identity section, enter the following:

    • NameID Format: Auto Detect
    • User Attribute for SAML Response Subject: Auto Detect

    

13. In the Statement Attributes section, enter the following attributes:

    1. Attribute Name: firstName
       Attribute Source: Identity Source
       Property: givenName, or the equivalent identity source property that contains the first name
    2. Attribute Name: lastName
       Attribute Source: Identity Source
       Property: sn, or the equivalent identity source property that contains the last name
    3. Attribute Name: email
       Attribute Source: Identity Source
       Property: mail, or the equivalent identity source property that contains the email address
       

14. Click Next Step.

15. On the User Access page, choose the access policy you want to use to determine which users can access the application, and then click Next Step.

    

16. On the Portal Display page, configure the portal display and other settings, and then click Next Step.

17. On the Fulfillment page, configure your preferred settings or leave the Fulfillment toggle disabled as it is, and then click Save and Finish.

18. Click Publish Changes and wait for the operation to complete.
    After publishing, your application is now enabled for SSO.

            

Configure Okta

Perform these steps to configure Okta.

Procedure

1. Log in to the Okta Admin Console with an administrator account.

2. In the left pane, browse to Security > Identity Providers and click Add Identity Provider.

   

3. Choose SAML 2.0 IdP from the list of available identity providers and click Next.

   

4. Enter a name for the RSA Cloud Access Service IdP.

   

5. Under Authentication Settings, enter the following:

   • In the IdP Usage drop-down list, choose SSO only.
   • Clear Account matching with Persistent Name ID.

   

6. Under Account matching with IdP Username, enter the following:

   1. IdP username: Choose idpuser.subjectNameId in the drop-down list.
   2. Match against: Choose Email in the drop-down list. This field specifies which attribute of an existing Okta user is compared to the IdP username to determine whether an account link must be established. If an existing account link is found, no comparison is performed.
   3. If no match is found: Choose the action for authentication responses that do not match an existing user in the Okta organization.

   

7. Under SAML Protocol Settings, enter the following and click Finish:

   1. IdP Issuer URI: Enter the Identity Provider URL obtained from the RSA configuration.
   2. IdP Single Sign-On URL: Enter the Identity Provider URL obtained from the RSA configuration.
   3. IdP Signature Certificate: Upload the certificate downloaded from RSA.
   4. Request Binding: Choose HTTP POST.
   5. Request Signature: If selected, Okta signs its AuthnRequest. CAS must then be configured to validate the Okta signing certificate.
   6. Request Signature Algorithm: Choose SHA-256.
   7. Response Signature Verification: Choose Response or Assertion. Okta accepts the required signature when either the response or assertion is signed.
   8. Response Signature Algorithm: Choose SHA-256.
   9. Okta Assertion Consumer Service URL: Choose Trust-specific to generate an ACS URL dedicated to the RSA SAML IdP trust.

   

8. After creating the IdP, under Summary, download the metadata for the Okta service provider.

   

9. Navigate to Identity Providers > Routing rules and click Add Routing Rule under the Routing Rules tab.

   

10. Enter the rule name, choose the newly created RSA IdP, and click Create rule.

    Routing rules define the conditions for requests that are routed to RSA. Conditions can use network zones, specific applications, or user domains.

    

11. Return to the RSA Cloud Administration Console and navigate to the Okta application you created.

12. On the Connection Profile page, under Data Input Method, choose Import Metadata and upload the downloaded Okta metadata.

    Accept the changes. The imported metadata replaces the temporary values that were entered earlier.

    

The configuration is complete.