Configure Federated Authentication from Okta

Download your Okta origination certificate.

1. In your Okta account, click Admin in the upper right corner to access the Administrator environment.

2. In the left-hand pane, navigate to Applications -> Applications.

3. Click Create App Integration. Select SAML 2.0 for the Sign-in method and click Next.

4. Fill in the App name text field with your desired application name.

5. Optionally, add a logo image and set app visibility. Click Next.

6. On the Configure SAML screen, enter the following information:

   Field	Value
   Single sign-on URL	http://localhost
   Audience URI	urn:idp:default

   Important

   These are placeholder values and are not intended for use in production. You will replace them in a later step.

   Leave the other fields empty or set to their default values and click Next at the bottom of the page.

7. On the Feedback screen, select I'm an Okta customer adding an internal app and click Finish.

8. At the bottom of the page under the heading SAML Signing Certificates, locate the newest certificate with a Status of Active--this is the certificate you just created.

   Click Actions and select Download certificate from the drop-down menu. The generated certificate is a .cert file. You must convert it to a .pem certificate for use later in this procedure. To do this, open a terminal of your choosing and run the following:

   openssl x509 -in path/to/mycert.crt -out path/to/mycert.pem -outform PEM

In MongoDB Cloud Manager, go to the Organization Settings page.

1. If it's not already displayed, select your desired organization from the Organizations menu in the navigation bar.

2. Click the Organization Settings icon next to the Organizations menu.

   The Organization Settings page displays.

Open the Federation Management Console.

In Federated Authentication Settings, click Open Federation Management App.

Provide Okta credentials to MongoDB Cloud Manager.

1. Click Identity Providers in the left-hand pane. If you have previously configured an IdP, click Add Identity Provider in the upper-right corner of the page, then click Setup Identity Provider. If you have not previously configured an IdP, click Setup Identity Provider.

2. On the Configure Identity Provider screen, enter the following information:

   Field	Value
   Configuration Name	Descriptive label that identifies the configuration
   Issuer URI	Fill with Placeholder Values
   Single Sign-On URL	Fill with Placeholder Values
   Identity Provider Signature Certificate	Certificate you received from Okta in a prior step
   Request Binding	HTTP POST
   Response Signature Algorithm	SHA-256

3. Click the Next button to see the values for the Okta configuration.

4. Click Finish.

Configure your SAML integration.

1. In your Okta account, return to the page for your SAML application and ensure the General tab is selected.

2. In the SAML Settings pane, click Edit.

   On the General Settings page, click Next.

3. On the Configure SAML screen, enter the following information:

   Okta Data Field	Value
   Single sign on URL	Assertion Consumer Service URL from the MongoDB Cloud Manager FMC. Checkboxes: Check Use this for Recipient URL and Destination URL. Clear Allow this app to request other SSO URLs.
   Audience URI (SP Entity ID)	Audience URI from the MongoDB Cloud Manager FMC.
   Default RelayState	Optionally, add a RelayState URL to your IdP to send users to a URL you choose and avoid unnecessary redirects after login. You can use: Destination RelayState URL MongoDB MongoDB Cloud Manager The Login URL that was generated for your identity provider configuration in the MongoDB Cloud Manager Federation Management App. MongoDB Support Portal https://auth.mongodb.com/app/salesforce/exk1rw00vux0h1iFz297/sso/saml MongoDB University https://auth.mongodb.com/home/mongodb_thoughtindustriesstaging_1/0oadne22vtcdV5riC297/alndnea8d6SkOGXbS297 MongoDB Community Forums https://auth.mongodb.com/home/mongodbexternal_communityforums_3/0oa3bqf5mlIQvkbmF297/aln3bqgadajdHoymn297 MongoDB Feedback Engine https://auth.mongodb.com/home/mongodbexternal_uservoice_1/0oa27cs0zouYPwgj0297/aln27cvudlhBT7grX297 MongoDB JIRA https://auth.mongodb.com/app/mongodbexternal_mongodbjira_1/exk1s832qkFO3Rqox297/sso/saml
   Name ID format	Unspecified
   Application username	Email
   Update application username on	Create and update

4. Click the Click Show Advanced Settings link in the Okta configuration page and ensure that the following values are set:

   Okta Data Field	Value
   Response	Signed
   Assertion Signature	Signed
   Signature Algorithm	RSA-SHA256
   Digest Algorithm	SHA256
   Assertion Encryption	Unencrypted

5. Leave the remaining Advanced Settings fields in their default state.

6. Scroll down to the Attribute Statements (optional) section and create four attributes with the following values:

   Name	Name Format	Value
   firstName	Unspecified	user.firstName
   lastName	Unspecified	user.lastName

   Important

   The values in the Name column are case-sensitive. Enter them exactly as shown.

   Note

   These values may be different if Okta is connected to an Active

   Directory. For the appropriate values, use the Active Directory fields that contain a user's first name, last name, and full email address.

7. (Optional) If you plan to use role mapping, scroll down to the Group Attribute Statements (optional) section and create an attribute with the following values:

   Name	Name Format	Filter	Value
   memberOf	Unspecified	Matches regex	.*

   This filter matches all group names associated with the user. To filter the group names sent to MongoDB Cloud Manager further, adjust the Filter and Value fields.

8. Click Next at the bottom of the page.

9. On the Feedback screen, click Finish.

Replace placeholder values in the MongoDB Cloud Manager FMC.

1. On the Okta application page, click View Setup Instructions in the middle of the page.

2. In the MongoDB Cloud Manager FMC, navigate to the Identity Providers page. Locate your Okta and click Edit.

3. Replace the placeholder values in the following fields:

   FMC Data Field	Value
   Issuer URI	Identity Provider Issuer value from the Okta Setup Instructions page.
   Single Sign-on URL	Identity Provider Single Sign-On URL value from the Okta Setup Instructions page.
   Identity Provider Signature Certificate	Copy the X.509 Certificate from the Okta Setup Instructions page and paste the contents directly.

4. Click Next.

5. Click Finish.

Assign users to your Okta application.

1. On the Okta application page, click the Assignments tab.

2. Ensure that all your MongoDB Cloud Manager organization users who will use Okta are enrolled.

In MongoDB Cloud Manager, go to the Organization Settings page.

1. If it's not already displayed, select your desired organization from the Organizations menu in the navigation bar.

2. Click the Organization Settings icon next to the Organizations menu.

   The Organization Settings page displays.

Open the Federation Management Console.

In Manage Federation Settings, click Visit Federation Management App.

Connect an organization to the Federation Application.

1. Click View Organizations.

   Cloud Manager displays all organizations where you are an Organization Owner.

   Organizations which are not already connected to the Federation Application have Connect button in the Actions column.

2. Click the desired organization's Connect button.

Apply an Identity Provider to the organization.

From the Organizations screen in the management console:

1. Click the Name of the organization you want to map to an IdP.

2. On the Identity Provider screen, click Apply Identity Provider.

   Cloud Manager directs you to the Identity Providers screen which shows all IdPs you have linked to Cloud Manager.

3. For the IdP you want to apply to the organization, click Modify.

4. At the bottom of the Edit Identity Provider form, select the organizations to which this IdP applies.

5. Click Next.

6. Click Finish.

Connect an organization to the Federation Application.

1. Click Organizations in the left navigation.

2. In the list of Organizations, ensure that your desired organization(s) now have the expected Identity Provider.