Connect Okta to PE
Connect to Puppet Enterprise (PE) to Okta so that users can log in to PE with their Okta credentials.
These steps assume you're familiar with common SAML terminology and the basic process to Connect a SAML identity provider to PE.
You must have an Okta instance. To test this process, you might request a development instance from the Okta Developer Portal.
Configure the Okta application
Configure settings in Okta to connect your Okta instance to Puppet Enterprise (PE).
Log in to the Okta Admin Console and navigate to
.The App Integration Wizard starts.
- Select SAML 2.0 for the Sign-in method, and click Next.
On the General Settings tab:
- Enter Puppet Enterprise for the App name.
- Optional: Upload an App logo and select App visibility options.
- Click Next.
On the Configure SAML tab:
- Paste the SAML assertion consumer service (ACS) URL from PE in the Single sign on URL field.
- Paste the SAML metadata URL from PE in the Audience URI (SP Entity ID) field.
- Optional: Set the Default RelayState.
- Select a Name ID format and Application username.
Click Advanced Settings, and specify parameters that
you'll match to service provider configuration options in PE later.
Tip: Take note of the Authentication context class setting. You'll need this value when you configure the Okta connection settings in PE.
- Select options for Response, Assertion Signature, Signature Algorithm, Digest Algorithm, and Assertion Encryption.
- Select Allow application to initiate Single Logout, and then paste the SAML Single Logout URL from PE in the Single Logout URL field.
- Paste the SAML assertion consumer service (ACS) URL from PE in the SP Issuer field.
- For the Signature Certificate, upload the file containing the Signing and Encryption Certificate from PE.
- Configure the Assertion Inline Hook, Authentication context class, Honor Force Authentication, and SAML Issuer ID.
- Click Next, complete the feedback survey (if desired), and then click Finish.
- Copy the URLs and download the certificate from the How to Configure SAML 2.0 for Puppet Enterprise Application page. You'll need this information to connect to Okta in the PE console.
Connect to Okta in the PE console
Configure your Okta integration settings in the Puppet Enterprise (PE) console.
- In the console, on the Access control page, click the SSO tab.
- Click Configure.
- Input a Display Name. This name is visible on the PE home page.
Complete the Identity provider information fields:
- Identity provider entity ID: Input the Identity Provider Issuer URL from Okta.
- Identity provider SSO URL: Input the Identity Provider Single Sign-On URL from Okta.
- Identity provider SLO URL: Input the Identity Provider Single Logout URL from Okta.
- Identity provider SSO response URL: Optional and can be blank.
- Identity provider certificate: Paste the entire X.509 Certificate from Okta, including the begin and end tags.
Configure the Service provider configuration options as
- Name ID encrypted?: Yes
- Sign authentication requests?: Yes
- Sign logout response?: Yes
- Sign logout requests?: Yes
- Require signed messages?: Yes
- Require signed assertions?: Yes
- Sign metadata?: Yes
- Require encrypted assertions?: No (leave unselected)
- Require name ID encryption?: No (leave unselected)
Requested authentication context: Input the value
of the Authentication context class from Okta in
- Requested authentication context comparison: Select minimum
- Allow duplicated attribute name: No (leave unselected)
- Validate xml?: No (leave unselected)
- Signature algorithm: Must match the Signature Algorithm setting you chose in Okta, such as rsa-sha256
- Input Organization and Contacts information.
The values in the Attribute binding fields must exactly
match the corresponding fields in Okta.
These settings define attributes and map them to user information in Okta, then PE uses these settings to understand user information received from Okta.
Your Okta Administrator can provide these details, or you can retrieve them from Okta. Navigate to Name fields in Okta to populate the Attribute binding fields in PE., and then use the values from the
- Commit your changes.
Configure RBAC for an Okta integration
In the PE console, connect Okta user groups to PE RBAC roles.
- In the console, on the Access control page, click the User roles tab.
- Click the Name of the PE role you want to connect to an Okta user group.
On the Member users tab, select the Okta data from the
User name drop-down menu, such as
$(user.firstName) $(user.lastName).The value for this option derives from the Attribute Statements data in Okta. If no such value is available on the drop-down menu, check the Attribute binding settings in PE (refer to Connect to Okta in the PE console for details).The Login and Status fields automatically populate after you select the User name.
- Switch to the Member groups tab and select the relevant Okta group from the Group name drop-down menu.
- Commit the changes.
- Repeat to configure additional groups.
Test your Okta SSO connection
Make sure you can log in to PE with Okta.
- Log out of PE.
- Go to the PE login screen (home page) and click Sign in with Okta SSO.
- Log in to PE using your Okta credentials.