Okta Authentication

Studio Conductor enables integration with your local Okta system to authenticate users and provide Role-Based Access Control. This guide describes the configuration steps required to enable Okta authentication.

Other SAML 2.0 authentication solutions can be integrated with Cloudify. However, only Okta is tested and officially supported.

Part 1: Configuring Okta

To configure Okta authentication in Studio Conductor, first add Studio Conductor as an application in your Okta system.

Okta Configuration Prerequisites

You’ll need Okta administrator privileges and your Studio Conductor IP address/URL (or load balancer IP address/URL for Studio Conductor HA cluster configuration).

Adding Studio Conductor as an Okta Application

1. Open the Okta Admin dashboard
2. From the top menu, choose Applications > Applications > Create App Integration
3. In the Create a new app integration form, choose SAML 2.0 as sign-in method
4. In the General Settings step, configure the application name, such as Cloudify Dev and add the logo.

5. In the Configure SAML step, configure the following in the SAML Settings section:

   • In General subsection:

     • add the Single sign on URL: https://cloudify-manager-ip/console/auth/saml/callback
     • make sure the box for Use this for Recipient URL and Destination URL is checked.
     • add the Audience URI: https://cloudify-manager-ip/console/auth/saml/callback

   • In Attribute Statements subsection add the following:

     • Name - firstname, Name Format - unspecified, Value - user.firstName
     • Name - lastname, Name Format - unspecified, Value - user.lastName
     • Name - email, Name Format - unspecified, Value - user.email
     • Name - username, Name Format - unspecified, Value - user.login

   • In Groups Attribute Statements subsection add all relevant user groups, or generally use:

     • Name - groups, Name Format - unspecified, Filter - Regex, Value - .*

6. In the Feedback step, define Studio Conductor as an internal app

7. Once a new Studio Conductor integration is created, you need to create at least one group in Directory > Groups section and assign relevant users to it.

Additional Configuration

• Provide the Okta Identity Provider Single Sign-On URL and X.509 Certificate to the Conductor Manager administrator. They can be found in: Application page > Sign on tab > Settings section > Sign on methods > View Setup Instructions

Part 2: Configuring Studio Conductor

To complete the Okta authentication configuration, Okta needs to be configured in the Conductor Manager.

Studio Conductor Prerequisites

You’ll need the following:

• SSH access to the Studio Conductor VM/s with sudo privileges
• Okta CA Certificate (provided by your Okta administrator)
• Identity Provider Single Sign-On URL (provided by your Okta Administrator)

Adding Okta Authentication in Studio Conductor

SSH into the Conductor Manager VM and follow these steps:

1. Add the Okta certificate for Studio Conductor (provided by your Okta admin, see above). Save the certificate as okta_certificate.pem in /etc/cloudify/ssl/

2. Restart Studio Conductor REST service using the following command:

   sudo supervisorctl restart cloudify-restservice

3. Configure the Conductor Management Console to use Okta with the following steps:

   • Copy default user configuration file to user data folder

     sudo -u stage_user cp /opt/cloudify-stage/conf/userConfig.json /opt/cloudify-stage/dist/userData 

   • Open the file /opt/cloudify-stage/dist/userData/config.json for editing

     • Under saml section change the values as follows:

       • enabled: true (enabling SAML mode)
       • certPath: “/etc/cloudify/ssl/okta_certificate.pem” (SAML certificate path which is used by the Conductor Manager and Conductor Management Console)
       • ssoUrl: <okta_sso_url> (redirect url to the application, Identity Provider Single Sign-On URL which can be found under Setup Instructions section of the newly created Studio Conductor app in Okta)
       • portalUrl: <organization_okta_portal_url> (redirect url to the organization portal: https://my-org.okta.com)

     • Remove all other configuration objects (except saml) from the file if you don’t plan to modify it

   • Restart the Conductor Management Console service using the following command:

     sudo supervisorctl restart cloudify-stage

4. Create new user-groups in Studio Conductor, matching the user groups in Okta (must be exactly the same names) using the following command for each group:

   cfy user-group create <user_group_name> -r <security-role>

5. Assign the user-groups to tenants using the following command:

   cfy tenants add-user-group <user_group_name> -r <role> -t <tenant_name>

Adding Okta Authentication in Studio Conductor HA Configuration

• The Load Balancer IP address (or URL) should be used for SSO URL in Okta
• Each Studio Conductor manager in the HA cluster must be configured according to the steps above.