Configuring SAML SSO with Okta - PortSwigger

SAML SSO is a protocol for web-based single sign-on that allows users to authenticate once and gain access to multiple applications without re-entering their credentials. This setup not only enhances user experience but also centralizes identity management, making it easier to manage access controls and audit trails.

What is SAML SSO?

SAML SSO is a standard protocol for exchanging authentication and authorization data between parties, typically an identity provider (IdP) and a service provider (SP). In the context of Okta and PortSwigger, Okta acts as the IdP, managing user identities and authenticating them, while PortSwigger acts as the SP, relying on Okta to authenticate users before granting access to its services.

How do you implement SAML SSO with Okta?

To implement SAML SSO with Okta, you need to configure an application in Okta and set up metadata exchange between Okta and the application. Here’s a step-by-step guide to help you through the process.

Step 1: Create a New Application in Okta

1. Log in to your Okta admin console.
2. Navigate to Applications > Applications.
3. Click on “Create App Integration”.
4. Select “SAML 2.0” and click “Next”.

Step 2: Configure the SAML Settings

1. General Settings:

   • Application Label: Enter a label for your application (e.g., “PortSwigger”).
   • Single sign-on URL: This is the Assertion Consumer Service (ACS) URL provided by PortSwigger.
   • Audience URI (SP Entity ID): This is the Entity ID provided by PortSwigger.
   • Name ID format: Typically, this is set to “Unspecified” or “Persistent”.

2. Attribute Statements:

   • Map the necessary attributes from Okta to PortSwigger. Common mappings include:
     • Email: user.email
     • Username: user.login
     • First Name: user.firstName
     • Last Name: user.lastName

Step 3: Download the SAML Metadata from Okta

1. After configuring the SAML settings, click on “Sign On Method” under the Sign On tab.
2. Click on “View Setup Instructions” to download the SAML metadata file.

Step 4: Configure PortSwigger to Use Okta as the IdP

1. Log in to your PortSwigger admin console.
2. Navigate to the SSO settings and select SAML.
3. Upload the SAML metadata file downloaded from Okta.
4. Configure any additional settings required by PortSwigger, such as:
   • Identity Provider Login URL: This is the SSO URL provided by Okta.
   • Identity Provider Issuer: This is the Entity ID provided by Okta.
   • Identity Provider Certificate: This is the public certificate provided by Okta.

Step 5: Test the Configuration

1. Save all configurations in both Okta and PortSwigger.
2. Test the SSO login by navigating to PortSwigger and attempting to log in. You should be redirected to Okta for authentication.

What are the security considerations for SAML SSO?

Security considerations include protecting private keys, validating signatures, and ensuring that the SAML assertions are encrypted and integrity-protected.

Protect Private Keys

Ensure that the private keys used for signing SAML assertions are stored securely and never exposed. Use secure key management practices to protect these keys.

Validate Signatures

Always validate the signatures of incoming SAML assertions to ensure they are genuine and have not been tampered with. This is crucial for maintaining the integrity of the authentication process.

Encrypt Assertions

Encrypt SAML assertions to protect sensitive information, such as user attributes, during transit. This prevents unauthorized access to this data.

Use Secure Connections

Ensure that all communications between Okta and PortSwigger are conducted over HTTPS to prevent interception and eavesdropping.

Troubleshooting Common Issues

Error: Invalid Signature

If you encounter an “Invalid Signature” error, ensure that:

• The public certificate uploaded to PortSwigger matches the private key used by Okta for signing assertions.
• The signature algorithm configured in Okta is supported by PortSwigger.

Error: Assertion Consumer Service URL Mismatch

If you receive an “Assertion Consumer Service URL Mismatch” error, verify that:

• The ACS URL configured in Okta matches the one specified in PortSwigger.
• There are no trailing slashes or discrepancies in the URLs.

Error: Audience Restriction Mismatch

If you see an “Audience Restriction Mismatch” error, check that:

• The Audience URI (Entity ID) configured in Okta matches the one specified in PortSwigger.
• Ensure there are no typos or case sensitivity issues.

Quick Answer

To configure SAML SSO with Okta for PortSwigger, follow these steps:

1. Create a new SAML 2.0 application in Okta.
2. Configure the SAML settings, including the ACS URL, Audience URI, and attribute mappings.
3. Download the SAML metadata from Okta.
4. Upload the metadata to PortSwigger and configure the SSO settings.
5. Test the SSO login to ensure everything is working correctly.

Security Best Practices

• Regularly rotate keys: Update your private and public keys periodically to minimize the risk of compromise.
• Monitor logs: Keep an eye on authentication logs for suspicious activity.
• Use strong encryption: Ensure that all data transmitted is encrypted using strong algorithms.
• Limit access: Grant access only to trusted applications and users.

That’s it. Simple, secure, works. Go ahead and implement SAML SSO with Okta for PortSwigger today.