Configure Administration Access using SAML

An Okta org can be integrated with the Access Gateway Admin UI to accept a SAML token for Okta for authentication. The following steps configure SAML access from an Okta org to Access Gateway and also add an application for accessing the Admin UI directly from an Okta org tile.

Configuring SAML Access involves three steps:

 

Create a token

  1. In your browser, Navigate to your Okta Org and Login as an Administrator.

  2. Click Security > API.

  3. Select the Tokens tab.

  4. Click the Create Token.

  5. Enter an appropriate name for the token.  For example OAG Admin Access Token.
    Note: All access to the Okta Access Gateway will be tracked using this token name.

  6. Select and copy the token value.
    Note: Token text is only available during creation. You will NOT be able to retrieve the text of the token at a later time.

Add an Okta idP

  1. In your browser, navigate to the Okta Access Gateway UI as Admin

  2. Click Settings.

  3. Select the Identity Providers tab.

  4. In the Identify Providers pane click the + icon and select Okta.

  5. Select the Identity Providers tab.

  6. Complete the Add New Okta IDP step by providing the following values

    Attribute Value
    Name A descriptive name
    Okta Org Your Okta Org URL. For example myorg.okta.com,
    Okta API Token API Token copied previously
    Description An appropriate description
  7. Click Not Validated.
    Note: If your token can be successfully validated then the yellow Not Validated button will become a green Validated button.

  8. Click Okay.

Configure SAML for Administrative access

  1. In your browser, return to your Okta org as Administrator.

  2. Navigate to Directory > Groups.

  3. Click Add Group.

  4. In the Add Group dialog name the group and add a description, then click Add Group.

  5. Click the name of the newly added group.

  6. Click Manage People and add all users who should be able to administer Okta Access Gateway.

  7. When complete, click Save.

  8. Return to the previously open Okta Access Gateway browser window.

  9. Select the Application tab.

  10. On the row representing the previously added idP, click Add.

  11. From the list of applications select Access Gateway AdminUI and click Create.

  12. In the Essentials section configure the following values and then click Next.

    Attribute Value
    Label OAG Admin Console
    Public Domain gw-admin.<yourdomain>
    Groups OAG Admin (group created previously)
    Description An appropriate description
  13. Click Next. The Attributes tab is displayed.

  14. Click Next. The Policies tab is displayed.

  15. Click Done.

  16. Log out of the OAG Admin UI Console.

Test

  1. Login to your Okta org as a user in the previously created Access Gateway admin group.
  2. You should see a notification has been added to the Access Gateway Admin UI.
  3. Click the application tile and you will be logged into the Access Gateway Admin UI as administrator.