OKTA / SAML SSO Integration

Guide to setup SAML SSO Integration

Information needed to complete the integration:

1. Single sign on URL: https://<COMPANY_SUBDOMAIN>.bucketlist.org/saml2/acs/
2. Audience URI (SP Entity ID): https://<COMPANY_SUBDOMAIN>.bucketlist.org/saml2/metadata/
3. Name ID Format: Email Address
4. Application Username: Email
5. Attribute Mappings:
   
   1. mail -> user.email (Name Format: Unspecified)
   2. cn -> user.firstName (Name Format: Unspecified)
   3. sn -> user.lastName (Name Format: Unspecified)
6. Signature verifying certificate -> Request Bucketlist product team for the public key signing certificate

Information required to provide BucketlistRewards

1. Metadata in XML (remote file URL or the file itself)
   
   

Once you provide XML metadata (remote or file), request Bucketlist product team to enable SAML SSO for the company.

Step by step guide for OKTA

1. Log into your OKTA admin and select "Applications" from left menu
    
2. Click on "Add Application" button
   
3. Click on "Create New App" button
   
4. In the create application dialog, select "Web" as platform and "SAML 2.0" as Sign on method. Click "Create" button to create the application.
   
5. On the "SAML Settings" screen, enter https://company-subdomain.bucketlist.org/saml2/acs/ as Single sign on URL and https://company-subdomain.bucketlist.org/saml2/metadata/ as Audience URI (SP Entity ID). Remember to replace "company-subdomain" with your company's actual subdomain. Select "EmailAddress" for Name ID format and "Email" for Application username.
   
6. For Attribute statements, add following mappings and press "Next"
   1. mail -> user.email (Name Format: Unspecified)
   2. cn -> user.firstName (Name Format: Unspecified)
   3. sn -> user.lastName (Name Format: Unspecified)
      
7. Select an appropriate option from the last screen and press "Finish" to complete the app
8. Next we need to assign the newly created app to people in our company. Otherwise, they would not be able to use the app. Select "Assignments" tab from top navigation of the newly created app.
   
9. Open the "Assign" dropdown and select "Assign to People"
   
10. From Assign dialog, search for people from your company, and click "Assign" button in front of their name.
    
11. Confirm that the "User Name" of the user is their email address and press "Save and Go Back".
    
12. Once done with all assignments, click the "Done" button to complete assign process.
    
13. Now click on "Sign On" tab of the app.
    
14. Right click the "Identity Provider metadata" link and copy the link location. Share this metadata URL with the Bucketlist product team.