IDE Services On-Prem SAML with Okta

Okta SAML Authentication

Prerequisites

• You have a valid Okta account.
• You have created an application.yaml file to configure your IDE Services Server.

Create App integration

To enable authorization, the first step is to register IDE Services in Okta by creating an application integration through the Admin Console. For more information about the procedure, refer to the Okta SAML documentation.

1. Open the Okta Admin Console in your browser and log in using your Okta account.

2. In the main menu, go to Applications | Applications to view current application integrations.

3. Click Create App Integration.

4. Select SAML 2.0 as the sign-in method.

5. Configure application:

   • App name: specify IDE Services

   • Single sign-on URL: specify the callback endpoint to redirect the end user - https://<ide_services_server_domain.com>/api/saml/authenticated

   • Audience URI (SP Entity ID): specify ServiceProvider (your IDE Services Server instance in this case) URI - https://<ide_services_server_domain.com>/api/saml/metadata

   • Name ID format: you can leave it as Unspecified

   • Application username: change it to Custom and set next value - user.displayName . This is a mandatory parameter to make SAML works as expected.

   • Click on Show Advanced Settings and make sure you have the same values as on the screenshot:

   • Then, we should add next Attribute Statements:

     • Name	Value
       email	user.email

     This is a mandatory parameter to make SAML works as expected.

   • Click on Preview the SAML assertion and ensure you have all values set correctly.

6. Click Next and Finish.

7. Once Application is created, switch to the Sign On tab and click on View SAML setup instructions link. The data presented there is needed for further application.yaml configuring.

Configure Okta in application.yaml

After creating an application integration in Okta, you need to configure your application.yaml file and specify the SAML provider properties there:

tbe:
    auth:
      internal-tokens:
        token-life: 30m
        refresh-token-life: 30d
        private-key: |
          <private_key_pkcs8.pem>
        public-key: |
          <public_key.pem>
      root-admin-emails:
        - "your.company.admin@example.com"
      saml:
        enabled: true
        sp-id: '${tbe.deployment.url}/api/saml/metadata'
        sp-assertion-consumer-service-url: '${tbe.deployment.url}/api/saml/authenticated'
        sp-x509cert: <local.crt> # please refer to the documentation - https://www.jetbrains.com/help/ide-services/saml.html#cert_key_generation
        sp-private-key: <local.key> # please refer to the documentation - https://www.jetbrains.com/help/ide-services/saml.html#cert_key_generation
        sso-url: '<Identity Provider Single Sign-On URL>'
        idp-x509cert: # download and put `X.509 Certificate`
        idp-id: '<Identity Provider Issuer>'
        cert-algorithm: sha256
        idp-http-method: 'POST'  #optional
        attribute-mapping:       #optional, if everything is configured according to the steps above, all mappings will be assigned automatically
          email: 'email'         #optional
          firstName: 'firstName' #optional
          lastName: 'lastName'   #optional

Additional notes:

If you changed any user's permissions or user's attributes on Okta side then it won't be updated on IDE Services side until you sync the users according to this guide or you delete the user in IDE Services and try to log in as this user again.