Skip to main content
Version: QB11

Single Sign-On with Okta (SAML)

Purpose​

This tutorial demonstrates how to set up QuickBuild to authenticate via Okta using SAML protocol

Assumptions​

  1. QuickBuild is accessed via https://build.example.com

Steps​

  1. Login to your organization account at Okta, and switch to Classic UI from Developer Console

  2. Add appropriate groups for QuickBuild, for instance qb.developers and qb.testers, and add your current Okta account into these groups

  3. Create new application in Okta, with platform being Web and sign in method being SAML 2.0 :

  4. Fill in general setting of the application, and click next:

  5. Fill in SAML settings as below and click next:

  6. Select appropriate options in feedback page and click finish:

  7. Okta will bring you to the Sign On tab after clicking finish button above. From here, click the Identity Provider Metadata link to show the content:

  8. Copy the metadata XML into clipboard

  9. Navigate to Assignments tab and make sure you've been assigned to the application:

  10. Now login to QuickBuild, navigate to page Administration/Security Setting and select SSO via SAML2 as SSO Provider . Paste the copied metadata from above step into field IdP Metadata

  11. Run below commands to generate SP private key and self-signed SP certificate:

    openssl req -x509 -nodes -days 365 -newkey rsa:4096 -keyout sp-key.pem -out sp-cert.crt
    openssl pkcs8 -topk8 -inform PEM -outform PEM -nocrypt -in sp-key.pem -out sp-key-pkcs8.pem

    Copy content of file sp-key-pkcs8.pem into field SP Private Key , and content of file sp-cert.crt into field SP Cert

    warning

    For Okta SAML integration, SP cert is actually not used as it does not verify authentication request signature. However other SAML integrations may require you to upload the SP cert to verify the signature.

  12. Specify email for field Email Attribute , and group for Group Names Attribute. Attributes specified here should be the same as you've specified at Okta side

  13. Specify a default group if necessary and save the setting

  14. Navigate to Group Management page and define groups with same name as we've defined in Okta, and assign appropriate permissions:

  15. Navigate to page Administration/System Setting , and make sure property Url to Access QuickBuild is specified as _https://build.example.com_

  16. Now logout and visit _https://build.example.com_ (make sure to visit the url specified in system setting), the sign in page should display a SSO login button

  17. Click this button and you will be taken to Okta site for authentication. If authenticated successfully, you will be logged into QuickBuild.

    warning

    You can still login to QuickBuild with normal user/password without clicking the SSO button

Last updated on