Chapter 3: Single Sign-On for a Great End User Experience

Single Sign-On (SSO) is a very user-friendly feature. But it also has great security benefits that will make any IT administrator happy.

In this chapter, we will look at Okta's SSO functionalities and how they will help your end users. We will look at how you can utilize the Okta Integration Network, but before that, we will look into the different connections you can make with various applications. We will also look at the difference between Okta- and application-initiated sign-on flows, as well as IdP discovery.

We will look at the following topics in this chapter:

• Using Single Sign-On with Okta
• Using the Okta dashboard and Okta Mobile app
• The Okta Integration Network
• Using Secure Web Authentication applications
• Using SAML and OpenID Connect applications
• Managing inbound SSO
• IdP discovery

Using Single Sign-On with Okta

While we will talk a lot about logging into different types of applications and their security steps, Okta, of course, has its own sign-in options. This is, in general, the cornerstone of every end user's experience. Their sign-on to Okta allows no further password inputs in any application beyond Okta. This first encounter with Okta's SSO ensures that the user has identified themselves according to the setup policies and are now allowed to sign into any integrated applications down the road.

The login process for Okta is straightforward and doesn't ask for any high-level understanding of the process. Signing in is as simple as any other application, but on the backend, you will see that Okta allows for a much more granular methodology, making sure all sign-ins are checked against any policy that has been set up.

Every Okta org is created with an Okta.com subdomain. These subdomains are determined at the moment the contract is signed...

Using the Okta dashboard and Okta Mobile app

Okta gives users a great experience by having a dashboard that all the user's applications are on. End users can arrange which apps go where and they can move them into different tabs to manage their environment even more. Okta's dashboard allows end users to set their personal passwords in applications and change and update these passwords later on. We will go through this in more detail later in this chapter. Depending on the settings, they can possibly also add personal applications through the personal application store, with over 5,000 applications. This only includes applications with passwords, because an end user cannot integrate Okta themselves with other applications using more integrable options.

Figure 3.10 – End user's application dashboard

Once a new application is added, the user will see a notification bubble after they get onto the dashboard. If they don't read it, the...

Simpler administration with Okta Integration Network

For many organizations, a reason to start using Okta is to avoid the upkeep of multiple integrations. This was a problem Okta saw early on, and the Okta Integration Network (OIN) has been an important cornerstone of Okta for a long time. At this time, the OIN is gathering over 6,500 integrations to applications within a variety of product types. What's unique about this collection is that all protocols for SSO and APIs for provisioning are maintained by Okta. Integrations are not only for cloud apps but a collection of on-premise, web-based applications are also represented within these integrations. The integrations are for Secure Web Authentication (SWA), Security Assertion Markup Language (SAML), and OpenID Connect (OIDC) integrations. For applications supporting any of these methods, even if it's on-premise or VPN services, it's possible to integrate with Okta, even though there is no existing integration in the...

Basic integration with Secure Web Authentication

As mentioned earlier, there are a few different kinds of integration, and one of them is SWA. This integration type was created for any application that doesn't support federated authentication. That means that the application does not support or allow an SSO flow where a user's authentication token is trusted across multiple systems or platforms. With SWA, Okta stores a user's credentials in a secure way, with strong encryption and a customer-specific private key. When an end user clicks on the application tile, the credentials are sent to the application login page via SSL. When setting up SWA integration, you can configure the credentials settings in the following ways:

• The user sets the username and password
• The administrator sets the username and password
• The administrator sets the username, the user sets the password
• The administrator sets the username, the password is the same as the Okta password...

Using SAML and OpenID Connect applications

To fully embrace the capabilities of Okta's SSO, it is recommended to use federation protocols such as Security Assertion Markup Language (SAML) and OpenID Connect (OIDC). Both handle and look at login flows differently, but they share one common feature, they allow an application to delegate their authentication to an Identity Provider (IdP) such as Okta. This means that there is no reason to have a password in your application anymore. The user is no longer responsible for a strong unused password, but the application will refer to the IdP for authentication. We will be looking at both, to see what they have in common and where they differ.

SAML is a framework built upon XML and allows interactions between an IdP and Service Provider (SP), to communicate user authentication, entitlement, and attribute information. The flexibility of the XML allows it be modified and to send different relevant information based on the integration...

Summary

In this chapter, you have been through the different integration methods supported by Okta, and how to integrate your organization's applications using the tools available. For your end users to access these applications via SSO securely, we've also looked into how to set password and sign-on policies and rules. To simplify login and the end user experience, we've also learned about inbound SSO and IdP discovery. We have also lightly touched upon the user dashboard and Okta Mobile application, to see how end users will integrate with Okta on a daily basis.

In the next chapter, we will go into the possibilities around multifactor authentication and the different settings and policies available.