Contents x
    How to configure Okta as an IDP
    • 5 Minutes to read
    • Print
    • Dark
      Light
    • PDF
    Contents

    How to configure Okta as an IDP

    • 5 Minutes to read
    • Print
    • Dark
      Light
    • PDF
    Article Summary

    Supported Features

    The Okta/Splashtop Secure Workspace integration currently supports the following features:

    • SAML
      • SP-initiated SSO
    • OIDC
      • SP-initiated SSO
    • SCIM
      • Create users
      • Update user attributes
      • Deactivate users
      • Group push

    For more information on the listed features, visit the Okta Glossary.

    Configuration Steps

    OKTA SAML setup

    Step 1: Accessing the Identity Providers Section

    1. Log in to your Splashtop Secure Workspace admin account using your credentials.
    2. Navigate to the Settings tab.
    3. Click on the Identity Providers section.

    Step 2: Adding a New SAML IDP

    1. In the Identity Providers section, click on the Add New button.
    2. Select SAML from the available options.

    image.png

    Step 3: Configuring the SAML IDP

    1. Enter the Display Name for the SAML IDP.
    2. Set the Enabled option to enable the SAML IDP.
    3. In the upcoming steps, we will utilize the Redirect URL and Entity ID located in the upper right corner of the page.
    4. Open a new tab to log in to the OKTA admin portal to open Applications → Browse App Catalog → Search for Splashtop Secure Workspace → Choose Splashtop Secure Workspace → Add Integration
    5. After add the Application label go to next page, then select SAML 2.0, fill in the Redirect URL and Entity ID we get in previous step, and change Application username formate to Email then click the Done button.
    6. After the Application is created, go to Sign On tab → SAML Signing Certificates → choose the Active cert → View IdP metadata

    Untitled1.png

    1. Open it in a new tab and then save it as metadata.xml

    2. Go to Assignments → assign the people/groups you like to assign to access the Splashtop Secure Workspace.

    3. Go back to the Splashtop Secure Workspace IDP config page, dragging and dropping the IDP metadata XML file just saved. This action will automatically populate the Single sign-on URL and Signing certificate fields. Click Save

      Untitled2.png

    4. Log out of the Splashtop Secure Workspace, and the SAML login button will show up, use the assigned OKTA user to login

    Step 4: OKTA SAML-SCIM setup

    1. Enable SCIM Splashtop Secure Workspace IDP config page

      1. Create or edit the created IDP in Splashtop Secure Workspace → settings → Identity Providers, check SCIM to enable this function (enable Sync group automatically to allow push group function sync group to Splashtop Secure Workspace automatically).
      2. When you check it, the system will display the Basic URL and API Token, which will be used in the next steps.
      3. Click Save to implement the change.
        Untitled3.png

    2. In OKTA App config SCIM

      1. In the created Okta app, Provisioning → Configure API Integration
      2. Check Enable API integration
      3. Fill in the URL and token obtained in previous step.
      4. Then Test API Credentials → then Save
      5. Save after the Test is successful
      6. Go to the Provisioning page → To App
      7. Enable following: Create Users, Update User Attributes, Deactivate Users and Save.
        image.png

    3. Assignments

      1. Open the created App in OKTA and select Assignments.
      2. You can assign users to this App individually, or select an entire group to assign its internal users to this App, click the Assign button in the upper left corner, and select Assign to Groups to assign by group

    4. Push Groups

      1. In Push Groups tab, click the Push Groups to select the groups you’s like to push to Splashtop Secure Workspace
      2. After the Push Status become Active, the push groups is done.

    OKTA OIDC setup

    Step 1: Accessing the Identity Providers Section

    1. Log in to your Splashtop Secure Workspace admin account using your credentials.
    2. Navigate to the Settings tab.
    3. Click on the Identity Providers section.

    Step 2: Adding a New OIDC IDP

    1. In the Identity Providers section, click on the Add New button.
    2. Select OIDC from the available options.
      image.png

    Step 3: Configuring the OIDC IDP

    1. Enter the Display Name for the OIDC IDP.
    2. Set the Enabled option to enable the OIDC IDP.
    3. In the upcoming steps, we will utilize the Redirect URL located in the upper right corner of the page.
    4. Open a new tab to log in to the OKTA admin portal to open Applications → Browse App Catalog → Search for Splashtop Secure Workspace → Choose Splashtop Secure Workspace → Add Integration
    5. After add the Application label go to next page, then select OpenID Connect, fill in the Redirect URL (OIDC) we get in previous step, and change Application username formate to Email then click the Done button.
    6. After the Application is created, go to Sign On tab, copy the Client ID and Client secret to fill in them the Splashtop Secure Workspace Identity Providers config page.
    7. Go to Assignments → assign the people/groups you like to assign to access the Splashtop Secure Workspace.
    8. For the Authorization url and Token url you need to get them from the https://${your_okta_domain}/.well-known/openid-configuration
      1. To look for: authorization_endpoint and token_endpoint
      2. eg. https://dev-98112303-admin.okta.com/.well-known/openid-configuration
        1. authorization_endpoint → Authorization url：https://dev-98112303.okta.com/oauth2/v1/authorize
        2. token_endpoint →Token url：https://dev-98112303.okta.com/oauth2/v1/token
    9. Now the OIDC configuration is done, log out of the Splashtop Secure Workspace, and the OIDC login button will show-up, use the assigned OKTA user to login

    Step 4: OKTA OIDC-SCIM setup

    1. Enable SCIM Splashtop Secure Workspace IDP config page

      1. Create or edit the created IDP in Splashtop Secure Workspace → settings → Identity Providers, check SCIM to enable this function (enable Sync group automatically to allow push group function sync group to Splashtop Secure Workspace automatically).
      2. When you check it, the system will display the Basic URL and API Token, which will be used in the next steps.
      3. Click Save to implement the change.

    2. In OKTA App config SCIM

      1. In the created Okta app, Provisioning → Configure API Integration
      2. Check Enable API integration
      3. Fill in the URL and token obtained in previous step.
      4. Then Test API Credentials → then Save

    3. Then come to the provisioning page, click edit, enable the functions: Create Users, Update User Attributes, Deactivate Users and then Save
      Untitled5.png

    4. Assignments

      1. Open the created App in OKTA and select Assignments.
      2. You can assign users to this App individually, or select an entire group to assign its internal users to this App, click the Assign button in the upper left corner, and select Assign to Groups to assign by group

    5. Push Groups

      1. In Push Groups tab, click the Push Groups to select the groups you’s like to push to Splashtop Secure Workspace, then click Save
      2. After the Push Status become Active, the push groups is done.
    Was this article helpful?
    What's Next