Okta Authentication Profiles
Each unique authentication profile is equivalent to its own Okta application.
Your Cirrus Implementation Lead will work with you to develop additional profiles & provide support for configuration.
An authentication profile includes a NameID format and value, set of attributes, and signing & encryption settings. A typical implementation will include a default profile for SAML and one for CAS. Additional profiles can be created if required.
Creating An Okta Application
Log in to Okta & navigate to Applications.
Select "Create app integration" (SAML 2.0).
Choose a name for your application.
For the default application, we recommend "Cirrus Default Bridge".
Configure SAML parameters.
Set the "Single Sign On URL" & "Audience URI (SP Entity ID)" provided by your implementation lead.
Signing & Encryption Settings
In Advanced Settings, we recommend the default application only sign the response to match default Shibboleth behavior.
Set the Name ID format to "transient" for the default Bridge.
Configure Attribute Release
Next, we will configure attributes for the application.
Default Profile: Research & Scholarship Attributes
To meet the REFEDS research & scholarship entity category requirements used by InCommon, you must configure the following attributes. We typically recommend you configure them on the default application.
| Attribute (friendlyName) | OID | Okta Value |
|---|---|---|
| Surname (sn) | urn:oid:2.5.4.4 | user.lastName |
| Given Name (givenName) | urn:oid:2.5.4.42 | user.firstName |
| Display Name (displayName) | urn:oid:2.16.840.1.113730.3.1.241 | user.displayName |
| Email address (mail) | urn:oid:0.9.2342.19200300.100.1.3 | user.email |
| eduPersonPrincipalName | urn:oid:1.3.6.1.4.1.5923.1.1.1.6 | user.login |
For additional authentication profiles (Okta Applications), use the Entity ID(s) or entity category URL for those application(s) and use the ACS URL from the default profile.
Asserting REFEDS MFA Profile
Okta can signal to the Cirrus Bridge that MFA was used if you release the session.amr attribute to Cirrus.
To do this, in Attribute Statements add the following attribute:
- Name: session.amr
- Format: Unspecified
- Value: session.amr
Okta may be configured to only release session.amr as a single value.
Cirrus needs the attribute to be released as multi-valued. To change this setting, you may need to make a request to Okta support to enable SAML_SUPPORT_ARRAY_ATTRIBUTES.
Assign App to Okta Group
Add the new application to the group created during the API Access setup to make it active for the Bridge.