To integrate with Okta, add a SAML application in your Okta account and in the Command Center. Metadata from the Okta application is shared with the Command Center application during this process.
Okta is a third-party identity provider (IdP) that can act as the IdP when your users log on to Commvault. Commvault is the service provider (SP).
Before You Begin
If you need to create a SAML app for a specific company, in the upper-right corner of the page, from the Select a company list, select the company that you want to create the SAML app for.
Create an Application in Okta
Create a new application using SAML 2.0 as the sign-on method.
Log on to your Okta account.
From the navigation pane, click Applications.
Click Create App Integration, and then select SAML 2.0.
Click Next.
The Create SAML Integration page appears.
On the General Settings tab, in the App name box, type a name for the application.
Click Next.
Under Configure SAML > SAML Settings, in the Single sign on URL box and the Audience URI (SP Entity ID) box, enter the URL for the Command Center.
For example, if you use Commvault Cloud, enter the URL as https://mnnn.metallic.io:443/identity where nnn is your ring number.
From the Name ID format list, select Email Address.
Continue to follow the prompts, accepting the default values.
Click Finish.
Open the application, and then click Sign On.
Under the View Setup Instructions button, click Identity Provider metadata, and then save the IdP metadata file as an XML file.
The identity provider metadata file that you save is the IdP metadata file that you will upload to Commvault.
Keep your Okta account open.
The value in the Single sign on URL box in Okta must be updated after a new URL is created in Commvault.
Add a SAML Application in Commvault
From the navigation pane, go to Manage > Security.
The Security page appears.
Click the Identity servers tile.
The Identity servers page appears.
In the upper-right corner of the page, click Add > SAML.
The Add SAML app page appears.
On the General tab, in the Name box, enter the domain name that you want to associate users with.
Note
The SAML application is created using the domain name.
For SAML user groups mapping to function correctly, the name that you enter here must be the same as your Commvault Cloud Tenant Name.
Click Next.
On the Identity provider metadata tab, in the Upload IDP metadata box, browse to the XML file that contains the IdP metadata, and then click Open.
The Entity ID and the Redirect URL from the file are displayed.
Click Next.
On the Service provider metadata tab, review the value in the Service provider endpoint box.
This value is automatically generated and is used in the SP metadata file. The format of the value is https://mycompany:443/identity.
To digitally sign the SAML message, move the Auto generate key for digital signing of SAML messages toggle key to the right.
Click Next.
On the Associations tab, identify the users who can log on using SAML:
To identify users by their email addresses, in the Email suffixes box enter an email suffix, and then click Add.
Note
You must use an email suffix as specified in the SAML integration settings to avoid integration issues.
If you face SAML integration issues, use a break glass account. The break glass account must be on different domain than that of the current domain.
To identify users by the companies they are associated with, from the Companies list, select a company, and then click Add.
To identify users by the domains they are associated with, from the Domains list, select a domain, and then click Add.
To identify users by the user groups they are in, from the User groups list, select a user group, and then click Add.
Note
If you migrate from an Exchange On-premises server to an Exchange Online server, you must add the appropriate domain and user group.
You can add any combination of associations, and you can add multiple associations in each category.
Click Next.
The Connectivity Test screen appears.
To add the SAML app in the IdP and test the connection:
Note
You can skip this step and click Finish to add the SAML app in the IdP, later. Further, you can test the connection on the SAML app page in the General section.
On the Connectivity Test screen copy the (Single Sign-On) SSO URL or download the SP metadata.
In a separate browser window:
Using the SSO URL and the SP metadata, create a SAML app in the IdP website.
In the SAML app that is created in the IdP, update the SSO URL or upload the SP metadata.
Note
Some IdPs such as OKTA require you to update the SSO URL, while other IdPs such as Azure require you to upload the SP metadata.
Sign out of any existing IdP sessions in your browser window.
On the Connectivity Test screen:
Click Test login.
A browser window appears.
Enter the email and password for a user to test the SAML login.
Close the browser window.
After the test login is successful, the SAML app will be enabled in the Command Center.
Click Finish.
The SAML app screen appears.
On the General tab, in the General section, next to the NameID attribute, click the Edit button
.From the NameID attribute list, based on the attributes in the IdP response, select either Email or User Principal Name.
Click Submit.
On the Service provider metadata tab, copy the value in the Single sign on url box.
.Update the Single Sign-On URL in Okta
In your Okta account, select the SAML application.
On the General tab, in the SAML Settings tile, click Edit.
Follow the prompts to specify the general settings.
Under Configure SAML > SAML Settings, in the Single sign on URL box, paste the URL that you copied from the Single sign on URL box in the Command Center.
Optional Okta Configurations
Configure Single Log Out in Okta
From the generated SP metadata XML file, copy the following information:
SP EntityId
SingleLogoutService location with POST binding
To download the signature certificate, log on to the Command Center, and then in your web browser, enter the SAML App URL in the following format:
https://commandcenter_hostname/commandcenter/downloadSPCertificate.do?appName=URL encoded SAML app name
For example, enter https://company.com/commandcenter/downloadSPCertificate.do?appName=app%20Name.
Press Enter.
In your Okta account, under General > Advanced Settings, select the Enable Single Logout box.
In the Single Logout URL box, enter the SingleLogoutService location that you copied from the SP metadata XML file.
In the SPIssuer box, enter the entityID that you copied from the SP metadata XML file.
In the Signature Certificate box, upload the certificate that you downloaded from the SAML app URL.
Click Next, and then click Finish.
On the Sign On tab, under the View Setup Instructions button, click Identity Provider metadata, and then save the new IdP metadata file as an XML file.
Go to the SAML application created in the Commvault.
On the Identity Provider Metadata tab, click the Edit button
.Upload the new IDP metadata file.
Click Save.
Give Other Okta Users Access to the SAML Application
In your Okta account, under Assignments, click Assign, and then select one of the following options:
To give access to individual Okta users, click Assign to People.
To give access to a user group, click Assign to Groups.
Select the user or user group that you want to give access to, and then click Add.
Add User Group Attribute Statements to the SAML Application
In your Okta account, under Group Attribute Statements, click Add.
In the Name box, enter user_groups.
In the Filter box, assign filters as required.
For example, to assign users from a user group name that starts with "domain users", select Starts With, and then enter domain users.
Preview the SAML assertion, and verify that your IdP response XML includes the user group attribute.
For example:
<saml2:Attribute Name="user_groups" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified"> <saml2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">GroupName Match Starts with "domain users" (ignores case) </saml2:AttributeValue></saml2:Attribute>In the Command Center, map the Okta user_group SAML attribute with the user group user attribute.
For information about mapping attributes, see Mapping SAML Attributes.
