Setting up Okta authentication - User Guide - BlueCat Horizon

1. Create the SAML application

1. In the Okta Admin Console, navigate to Applications > Applications > Create App Integration.
2. Select SAML 2.0.

2. Configure SAML settings

1. In the provided fields, enter the values from the metadata file you downloaded previously:
   • Single sign-in URL: Enter the AssertionConsumerService URL
   • Audience URI (SP Entity ID): Enter the entityID
2. Select Show Advanced Settings.
3. Locate the <KeyDescriptor use="signing"> section.
4. Locate the <ds:X509Certificate> tag and copy its full value (the long encoded string).
5. Create a new .PEM file and format the certificate as follows:

   -----BEGIN CERTIFICATE-----
    <paste the copied certificate here> 
   -----END CERTIFICATE-----

6. Save the file, for example, as signing-cert.pem.
7. Navigate to Signature Certification > Browse files and upload the .PEM file you created.
8. Enable Signed Requests.
9. Save the configuration.

3. Configure attribute statements

In Okta, the values configured under Attribute Statements represent SAML claims that will be sent to BlueCat Horizon in the SAML assertion.

Each attribute consists of:

• Name: The claim identifier expected by BlueCat Horizon
• Value: The Okta expression that defines what data is sent

1. Add the following attributes using Add expression:

   Name	Value	Type	Expected format
   https://bluecatnetworks.com/saml/claims/emailaddress	user.profile.email	String	Full user email address, for example user@example.com
   https://bluecatnetworks.com/saml/claims/groups	user.getGroups({'group.profile.name': ''}).![profile.name]	Multi-valued (string array)	List of group names
   https://bluecatnetworks.com/saml/claims/name	user.profile.firstName + " " + user.profile.lastName	String	User's full name

   The example group expression returns all groups assigned to the user. Group mapping is defined based on your requirements and may differ from the provided examples.

   Note:

   • The Groups claim must return a list of strings, not a single value.
   • Each group name must exactly match a group configured in BlueCat Horizon.
   • If no matching groups are found, the user will be authenticated but will not have any permissions.

   (Optional) You can restrict which groups are sent, for example:

   user.getGroups({'group.profile.name':
                   'Horizon-.*'}).![profile.name]

4. Assign users

1. Navigate to Applications > Applications > <App Name> > Assignments > Assign.
2. Assign the users or groups that should be allowed to log into BlueCat Horizon. Make sure the groups match the ones you created in BlueCat Horizon for your external users.

5. Retrieve Okta identity provider information

1. Navigate to Applications > Applications > <App Name> > Sign On.
2. Copy the following values:
   • Sign on URL
   • Signing Certificate

   The certificate must include the following:

   -----BEGIN CERTIFICATE-----
    ...
   -----END CERTIFICATE-----

6. Update the SSO connection

1. In BlueCat Horizon, navigate to Administration > Single sign-on.
2. Your SSO connection and its details should be displayed, including the placeholder values. Select Edit.
3. In the dialog, replace the placeholder values with the real ones from your SSO configuration:
   1. Enter the Sign on URL value from your Okta configuration into the Sign in URL field.
   2. Drag and drop or upload the Signing Certificate .PEM file from Okta into the Signing certificate field.
4. Select Update.