How to enable Okta for SSO

To integrate Okta SSO for Atlan, complete the following steps.

Choose SSO provider (in Atlan)

To choose Okta as your SSO provider, within Atlan:

1. From the left menu on any screen, navigate to Admin.
2. Under the Workspace heading, click SSO.
3. Under Choose SAML provider, select Okta and then click Configure.
4. Under Service provider metadata, copy the Single sign on URL and Audience URI (SP Entity ID).

Set up SAML app (in Okta)

To set up a SAML app, within Okta's administration console:

1. From the menu on the left, expand Applications and then click on Applications.
2. At the top of the table, click the Create App Integration button.
3. In the Create a new app integration dialog, select SAML 2.0 and then click Next.
4. Under General Settings enter:
   1. For App name, enter a name for the application, such as Atlan.
   2. Click the Next button.
5. Under SAML Settings - General enter:
   1. For Single sign on URL enter the value you copied from the field of the same name in Atlan above.
   2. Ensure Use this for Recipient URL and Destination URL is enabled.
   3. For Audience URI (SP Entity ID) enter the value you copied from the field of the same name in Atlan above.
6. Under Attribute Statements (optional) define the following mappings from Name (Name format) on the left to Value on the right:
   1. firstName (Basic) —> user.firstName
   2. lastName (Basic) —> user.lastName
   3. email (Basic) —> user.email
   4. group (Basic) —> user.group
   💪 Did you know? For users assigned to Atlan through SSO, the username will be populated from the username mapping. Otherwise, the username will be the email prefix by default, which users can update while registering on Atlan for the first time.
7. Under Group Attribute Statements (optional) define the following mappings from Name (Name format) on the left to Filter on the right:
   • memberOf (Unspecified) —> Matches regex [\s\S]+ — for examples of how to filter groups with regex in Okta, refer to Okta documentation. This is required if you want to retain group membership in Atlan.
8. At the bottom of the form, click the Next button.
9. Under Help Okta Support understand how you configured this application select I'm an Okta customer adding an internal app and for App type enable This is an internal app that we have created.
10. Click the Finish button.

Download Okta's metadata file (in Okta)

To download Okta's metadata file, within the Okta app's page:

1. Open the Sign On tab.
2. Under the SAML Signing Certificates heading, in the table, click the Actions link under the Actions column.
3. From the drop-down, click View IdP metadata.
4. Save the XML file, if it appears in plain text in your browser.

Assign users to the app (in Okta)

To assign users to the app, within the Okta app's page:

1. Open the Assignments tab.
2. At the top of the table, click the Assign button and select Assign to People to add individual users or Assign to Groups to add groups.
3. To the right of each user to whom you want to assign the application, click Assign. To assign the application to a group, you may have to locate it first.
4. For individual users, confirm that the data is correct in the Assign Atlan to People dialog. For groups, complete the fields in the Assign Atlan to Groups dialog if it appears.
5. Click Save and Go Back. Repeat steps 3 to 5 for each user or group to which you want to assign the application.
6. When finished, in the respective dialog box, click Done.

Upload Okta's metadata file (in Atlan)

To complete the configuration of Okta SSO, within Atlan:

1. From the left menu on any screen, navigate to Admin.
2. Under the Workspace heading, click SSO.
3. Under Choose SAML provider, select Okta and then click Configure.
4. To the right of Identity provider metadata click the Import from XML button.
5. Select the XML file saved from Okta above.
6. At the bottom of the screen, click Save.

Congratulations — you have successfully set up Okta SSO in Atlan! 🎉

(Optional) Configure group mappings

To automatically assign Okta users to Atlan groups based on their Okta groups, within Atlan:

1. From the left menu on any screen, navigate to Admin.
2. Under the Workspace heading, click SSO.
3. Change to the Groups Mapping tab.
4. To the right of each Atlan group listed:
   1. Under the SSO Groups column, type the name of the corresponding group in Okta to map to the Atlan group on that row — for example, Data Engineering, Business Analysts, and so on. You will need to provide each Okta group with access to Atlan.
   2. Click the Save button on that row.

As each user signs up to Atlan, they will be automatically assigned groups in Atlan based on these mappings! 🎉