Using Okta for Authentication and SSO with Liferay

Clarity is leveraging Okta’s Workforce Identity Cloud product to manage their employee information. Okta is a Cloud based Identity Management service that allows Clarity to securely manage their employee’s identity information and manage secure authentication into the applications they use. Okta provides many different features, but for this training we’re going to be focusing on their support of the SAML protocol to support single sign-on.

What is SAML?

SAML stands for Security Assertion Markup Language and is an open standard used for authentication. SAML works by passing authentication information in a specific format between two applications, an Identity Provider (IdP) and a Service Provider (SP). By using SAML, Clarity employees only need to remember one set of credentials to access all their SAML-enabled applications, eliminating the need for multiple logins. Additionally, Okta securely stores these credentials, reducing the risk of data breaches compared to individual app logins. Okta’s robust security features like multi-factor authentication and streamlined password resets further enhance protection against common attacks.

In this context and using this language, Okta is configured as the Identity Provider (IdP) and Liferay will be acting as a Service Provider (SP).

Configuring Okta as an IdP

In your Okta developer account, create a new group called Okta-IT. Then create the following user:

Field	Value
User type	Select User
First name	Jane
Last name	Newton
Username	jane@clarityvisionsolutions.com
Primary email	jane@clarityvisionsolutions.com
Groups	Okta-IT
Password	select Set by admin and input LearnLiferay as the password
User must change password on first login	unchecked

Exercise 1: Configuring Okta as an Identity Provider

In order to configure Okta as an Identity Provider for your Liferay instance, you will need to provide it with the URL of your Liferay instance. As part of this process, you will prompt Okta to generate a metadata .xml file that you will need in order to configure Liferay as a Service Provider in a later exercise.

Follow these steps in Okta to configure Okta as an Identity Provider:

1. Log in to Okta Dev. In the left menu, click on Applications under the applications sub-section. In the new page click Create App Integration.

2. Select SAML 2.0 and click Next.

3. Enter liferay-saml-{your.name} as the app name and click next.

4. Enter the following fields:

   • Single sign-on URL: http://[your_lifray_saas_environment]/c/portal/saml/acs
   • Audience URI (SP Entity ID): samlspdemo
   • Name ID format: EmailAddress
   • Application username: Email

   

5. Add the following attribute statement:

   Name	Name Format	Value
   screenName	Unspecified	user.firstName
   firstName	Unspecified	user.firstName
   lastName	Unspecified	user.lastName
   emailAddress	Unspecified	user.email

6. Add the following group attribute statement:

   Name	Name Format	Filter	Value
   userGroup	Unspecified	Starts with	Okta

7. Click Next at the bottom of the page. Finally, click Finish on the next page.

8. On the Sign On tab, confirm that Application username format is set to Email.

9. Click View SAML Setup Instructions on the right side of the page. A new page will open.

   

10. Under the Optional heading, select and copy all the xml text. Paste the block of text into a new text file and save the file with the name oktametadata.xml.

11. Next, click on the Assignments tab of your application. Click Assign and select Assign to People. Click Assign next to Jane Newton.

    

    In the next window, click Save and Go Back.

12. In the list of users, click Assign for your own user account as well. Click Save and Go Back.

Exercise 2: Configuring Liferay as a Service Provider

Follow these steps in Liferay to configure Liferay as a Service Provider:

1. In Liferay, navigate to Control Panel → Security → SAML Admin.

2. Set the SAML Role to Service Provider, and Entity ID to samlspdemo. Click Save.

3. Click Create Certificate under the certificate and private key section. Input the following:

   • Enter the common name as okta-saml.
   • Scroll down to the bottom. Input the key password as learn.
   • Click Save.

4. Leave the default settings under the Service Provider tab.

5. Click the Identity Provider Connections tab. Click Add Identity Provider and set the following:

   1. Name: okta

   2. Enter the entity ID (found in xml file as entityID)

   3. Check the Enabled box

   4. Under the Metadata section, choose Upload Metadata XML and upload the oktametadata.xml file created previously

   5. Set Name Identifier Format to Email Address

   6. Enter the following attribute mappings under Basic User Fields:

      User Field Expression	SAML Attribute
      emailAddress	emailAddress
      firstName	firstName
      lastName	lastName
      screenName	screenName

   7. Enter the following attribute mapping under Group Attribute Statements:

      Name	Name format	Filter	Input
      userGroup	Unspecified	Starts with	Okta

      Note

      This importing user groups through SAML feature is currently behind a dev feature flag.

   8. Click on Save

6. Go back to General tab and make sure the Enabled checkbox is checked. Click Save.

7. Log out of your Liferay instance and click Sign In in the top right corner. You are redirected to the Okta login page.

   

   Important

   Note, if you have previously logged in with Okta, you may need to try with your browser in incognito mode.

8. Input the user name jane@clarityvisionsolutions.com and the password LearnLiferay. You have successfully logged in as a Clarity team member.

9. Log out of the account and sign back in with your Liferay administrator account.

10. Navigate to Control Panel → Users and Organizations. Verify that Jane Newton’s account came into Liferay and that she was automatically assigned to the Okta-IT Liferay user group.

    

Conclusion

Great job! Your Liferay instance is now integrated with Okta and Clarity’s employees have a clear path to begin authenticating to Liferay! Later on we will get into how to configure roles and permissions for those users, but next we will turn our attention to Clarity’s Business Partners and Guest users.

Next Up: Managing Clarity Business Partners and Guests

Additional Resources

See our documentation to learn more about configuring SSO with other identity management solutions or integrating user directories with Liferay:

• Configuring Single Sign-On
• Connecting a User Directory
• Configuring Liferay Authentication With Okta Using OpenId Connect
• Configuring Liferay Authentication With Auth0 Using OpenId Connect