Setting Up Single Sign-on Integration with Okta

• Different eSPACE Subscription Tiers include Different Features Including Single Sign On
  • Click here to see which features are included with each tier!

• Viewing Your Subscription Details
  • Each eSPACE admin with access to Billing can view what subscription tier your organization currently has and everything that is included in their account under Settings > Other > Billing > Manage.

For those who are on an eSPACE subscription tier that includes Single Sign On, before you begin, we strongly encourage you to review our article: How Okta Single Sign-On Works before proceeding.

In eSPACE:

1. Login to eSPACE as a user with administrative privileges.  NOTE:  Only eSPACE Admins can get to the SSO Integration Setup page in eSPACE
2. Navigate to Settings >> Other >> Developer >>Single Sign-on
3. Select Okta as the provider
4. Copy the entire Single Sign On URL and paste it in a text editor for later use.  It is the URL that looks something like this:
   
5. Open a new tab, go to your Okta account, and continue with the steps in the "In Okta" section below.  DO NOT close or save your progress in eSPACE just yet.

In Okta

1. Sign in to your organizations Okta account using a login account with administrative privileges.
2. Navigate to the admin panel, then to Applications >> Applications.
3. Click to "Create App Integration"
4. Select "SAML2.0" and click Next
5. Fill in the General Settings as follows, then click "Next"
   1. App Name: eSPACE
   2. App Logo: (download from here)
   3. App Visibility - Whatever your organization's preferences are.
6. Fill in the "Configure SAML" tab as follows and click "Next"
   1. General Section
      1. Single sign on URL: This should be the value from #4 in the eSPACE setup section above.
      2. Ensure "Use this for Recipient URL and Destination URL" is checked.
      3. Audience URI: ministryID
      4. Name ID format: EmailAddress
      5. Application Username: Email
      6. (This item may not be visible) Update Application Username on: Create and update
   2. Attributes Statement: Add the following attributes:
      
7. On the Feedback page, select "I'm an Okta customer adding an internal app".  Leave all other default options and click "Finish"
8. Return to the "General" tab and scroll down to the App Embed Link section.  Find the URL in the "Embed Link" field and copy the entire address.  You will be pasting this into a setting field in eSPACE.
   
   
   
9. Go back to your eSPACE tab in your browser and continue with the eSPACE setup.

Back in eSPACE on the SSO Setup page.

1. Find the "Okta Identity Provider Single Sign-On URL" and set it to the value you copied from step 9 in the previous section.  It should be something like this:
   
2. Select an Integration Admin.  This person will be notified when someone tries to access eSPACE from Okta, but they don't have an eSPACE account.  eSPACE will create an account for them, but set them to be "inactive" and send a notification to the Integration Admin to let them know (and activate their account in eSPACE

And finally, back in Okta, go to the Assignments tab.  If you were last on the "How to configure SAML 2.0 for eSPACE..." page, you may need to go back, or switch to the other browser tab for Okta to find the "Assignments" tab.  Use the "Assign" button to specify which Okta users are permitted to access your organization's eSPACE account.  If they do not have an eSPACE account, or they do but with a different email address, one will be created for them the first time they try to login via Okta SSO.  Please be sure to see our article How Okta Single Sign-On Works for more details.