Integration Guide

Okta SSO Configuration

Prerequisites

Stages

IdP configuration requires an existing Stages user account with sufficient permissions. Contact your Stages system administrator with any issues.

Okta Tenants

  • Each Stages Application requires its own individual Okta tenant
  • Multiple instances within a single tenant are not supported

Supported Features

Okta Application

Installation

  1. In Okta Console, go to Applications; select "Browse App Catalog"
  2. Search for Bold Group Stages and click "Add Integration"
  3. Configure the required General Settings:
    Application Label
    Descriptive label for the application instance
    Stages App Domain
    Stages Application URL, e.g. stages.example.com/stagesactive
    Do not include protocol (e.g. "https://") or trailing slashes
    Audience
    Any string up to 1024 characters long
  4. Record the Stages App Domain and Audience values below. They will be used in the Stages configuration steps.
    Stages App Domain
    Audience
  5. Click Save; the browser redirects to the application's configuration page

Configuration

Warning

This section must be completed before any users are added to the application. These values must be configured as indicated and remain unchanged.

  1. In the application's configuration, select the Sign-On tab
  2. In the Settings section, click Edit
  3. Under Configured SAML Attributes, complete the groupList attribute:
    Dropdown field
    Matches regex
    Input field
    .*
  4. Under Metadata details, select the More Details dropdown.
  5. Record the given value for Sign on URL:
    Sign on URL
  6. Record the given value for Issuer:
    Issuer
  7. Select Signing Certificate > Download. This will also be required for Stages configuration.
  8. Scroll down to Credentials Details and update the following:

    Application username format

    Dropdown field
    Custom
    Input field
    user.getInternalProperty("id")

    Update application username on

    Dropdown field
    Create only
  9. Click Save

Stages Application

Configuration

  1. Log into Stages with a user capable of configuring Identity Provider records
  2. Open Utilities > Stages > Application Options, select the Identity Providers tab and desired Application number
  3. Click Add new Identity Provider. Configure using the field mapping below:
    description
    A human-readable description of the Identity Provider
    id
    signing algorithm
    RSA509
    destination
    (enter Stages App Domain above)
    provider type
    SAML
    login procedure
    wLoginByIdentityProviderOKTA
    audience
    signonurl
    site group
    (Application 2 only)
    Restricts use of an Application 2 IDP to the defined Site Group number
  4. Click Save
  5. In Upload Public Key, upload the Signing Certificate downloaded from Okta. Click Save.
  6. Restart the IIS application pool for the applicable Stages application (e.g. StagesActive, StagesExternal) for the new configuration to take effect.