Skip to main content

Okta SSO

Okta SSO provides a single, unified login experience for users to access multiple applications without re-entering their credentials for each service. This guide explains how to add Cloudaware as an external application in a customer-managed Okta tenant.

info
  • Audience: Cloudaware administrators, IAM teams
  • Outcome: Okta is enabled as a Cloudaware authentication service, and users can sign in with Okta-managed identities and optional group-based RBAC mapping

Prerequisites​

Before you begin, make sure you have:

  • Access to a Cloudaware account.
  • Your Cloudaware domain (for example, your_cloudaware_domain.my.salesforce.com)
  • A Cloudaware Administrator user (access to the Salesforce Setup)
  • Okta role that can create applications (for example, Super Admin, Org Admin, App Admin, or a custom role with app permissions)
  • Agreed identity attributes:
    • Unique user identifier (commonly email)
    • Username format for Salesforce (must be globally unique)
    • Group claim source (Okta groups/app groups), if you plan to map groups → permission sets

High-Level Setup Flow​

  1. Set up the SAML app in Okta
  2. Configure SAML + (optional) JIT provisioning attribute statements
  3. Assign users/groups and copy the Okta metadata URL/XML
  4. Create the SSO setting in Cloudaware (in the Setup menu)
  5. Enable the SSO method under My Domain authentication configuration

Setup In Okta​

Create The App Integration​

  1. Sign in to the Okta Admin Console.
  2. Navigate to Applications → Applications.
  3. Click Create App Integration, select SAML 2.0 as the sign-in method, then click Next.
  4. Enter a name for the app (for example, Cloudaware), then click Next.

Configure SAML Settings​

In the SAML settings page, set the following values (replace <your_cloudaware_domain>):

  • Single sign-on URL: https://<your_cloudaware_domain>.my.salesforce.com
    • Select Use this for Recipient URL and Destination URL.
  • Audience URI (SP Entity ID): https://<your_cloudaware_domain>.my.salesforce.com
  • Default RelayState (optional but recommended):
    • https://<your_cloudaware_domain>.lightning.force.com/CA10UI/lca.app (lands users on CMDB main page)
  • Name ID format: EmailAddress
  • Application username: Okta username
  • Update application username on: Create and update

Add Attribute Statements (JIT Provisioning)​

If you want Just-In-Time (JIT) user provisioning, add attribute statements in Okta for the Salesforce JIT fields.

Recommended mappings:

  • User.Username
    • Salesforce usernames must be globally unique.
    • Use an Okta expression to enforce uniqueness. Example: String.join("-", "cloudaware", user.email)
  • User.FirstName: user.firstName
  • User.LastName: user.lastName
  • User.Email: user.email
  • User.ProfileId
    • Set to the Salesforce Profile ID you want JIT-created users to have (for example, Cloudaware Administrator/Cloudaware User).
    • Tip: you can copy a Profile ID from the Salesforce profile page URL in Setup → Profiles.
  • User.IsActive (optional): true
    • If you have automation that deactivates users after inactivity, this helps ensure deactivated users can be reactivated on login.

Add Group Claims (For RBAC Mapping)​

If you map IdP groups to Cloudaware permission sets/profiles, add a groups attribute statement (Okta supports group attribute statements with filters/regex).

  • Attribute name: Groups (or whatever your Cloudaware/Salesforce mapping expects)
  • Filter: choose a pattern that returns only the Cloudaware-relevant groups

Assign Users And Save The Okta Metadata URL​

  1. Open the app’s Assignments tab and assign users/groups.
  2. Open the Sign On tab and copy the Metadata URL.
  3. Use either:
    • The metadata URL directly, or
    • The downloaded XML (open the URL in a browser and save as .xml)

Both are valid for the Cloudaware/Salesforce setup steps below.

Setup In Cloudaware​

Enable SAML​

  1. Log in to Cloudaware, go to Setup.
  2. In Quick Find, type Single.
  3. Under Identity, open Single Sign-On Settings.
  4. Ensure SAML Enabled is checked.
    • If not, click Edit, enable it, and Save.
  5. (Optional) Federation ID case-sensitivity:
    • By default, Federation IDs are case-sensitive.
    • If required, enable Make Federation ID case-insensitive.

Create The SSO Setting​

Create a new SSO setting using one of the options below.

Option 1 — Metadata URL​

If you use the metadata URL, add the Okta metadata URL domain to Remote Site Settings first:

  1. In Quick Find, type Remote.
  2. Under Security, open Remote Site Settings → New Remote Site.
  3. Set a name for the remote site and paste the Okta metadata URL.
  4. Click Save.
  5. Return to Single Sign-On Settings and click New from Metadata URL.
  6. Paste the metadata URL and click Create.

Option 2 — Metadata File (XML)​

  1. In Single Sign-On Settings, click New from Metadata File.
  2. Upload the XML file.
  3. Click Create.

Configure SAML Single Sign-On Settings​

On the newly created SSO setting, configure:

  • Name: a descriptive name (for example, okta)
  • SAML Identity Type:
    • If JIT is required, select Assertion contains the Federation ID from the User object
  • Just-in-time User Provisioning:
    • If JIT is required, check User Provisioning Enabled
    • Set User Provisioning Type to Standard

Click Save.

Enable Okta As An Authentication Service (My Domain)​

  1. In Quick Find, type My Domain.
  2. Open My Domain.
  3. In Authentication Configuration, click Edit.
  4. Enable the checkbox next to the new SSO configuration (for example, okta).
  5. Click Save.

Troubleshooting​