Set Up SAML SSO for Okta

Copy Eon's service provider details

In Eon, go to the SAML SSO global management page. Click Add Identity Provider. Once you have at least one identity provider, this button is a icon in the header of the Identity providers panel.

The Add identity provider dialog lists Eon’s service provider details, which you’ll paste into Okta, each with a copy button. Keep the dialog open because you’ll need these values in the next step.

Configure the SAML integration in Okta

1. Click Add Integration. Okta’s account selection page is opened.

2. Choose your Okta organization and log in.

3. In the app’s General settings page, fill in the form:

   

   1. In Application label, give a meaningful name, such as Eon.io.

   2. Copy Eon’s service provider details from the Add identity provider dialog you left open in Eon:

      Okta field	Eon field
      Eon Domain	Eon account domain
      Entity ID	Service provider entity ID

   3. In Application Visibility, leave Do not display application icon to users unselected.

4. Click Done.

The app is created and you’re redirected to Okta’s app information page.

Add user groups to the claim

Configure the app to send user group membership with the SAML assertion so Eon can map users to the correct roles.

1. In the Sign On tab, in the Settings section, click Edit.

2. In the Configured SAML Attributes section, set groups to Matches regex and type .* in the text box.

   If too many groups are sent with the SAML assertion, the request can become malformed and cause login failures. As a best practice, filter the groups sent to only those relevant to the Eon app. For example, use a regex pattern like ^EON_.* to send only groups that start with EON_.

3. Click Save.

Assign the Okta app to user groups

Assign the Eon app to user groups to control which users can access Eon through SAML SSO.

In the Assignments tab, click Assign > Assign to Groups. Choose the groups you want to be able to access Eon.

Copy the SAML settings to Eon

Return to the Add identity provider dialog in Eon.

1. Give a meaningful Display name, such as Okta. You can’t change it later, so pick a name you’ll recognize.

2. Provide the corresponding SAML details from Okta. You can find these settings in the Sign On tab by expanding More details:

   Eon field	Okta field
   SSO URL	Sign on URL
   Issuer URL	Issuer
   SLO URL	Sign out URL
   Public certificate	Download the Signing Certificate

   Important

   Eon requires the entire contents of the certificate, including the BEGIN CERTIFICATE and END CERTIFICATE lines. Copying the signing certificate directly from Okta omits these lines, so you’ll need to download the certificate and copy its contents from the .cert file.

3. Click Add Identity Provider.

Map SAML groups in Eon

Although SAML SSO is now enabled on your Eon account, SAML users can’t log in yet because they have no Eon access by default. To grant access, you need to map your SAML groups in Eon.

Click Add Group Mapping. The New group mapping dialog opens.

Set these options:

• SAML identity provider: Choose the Okta identity provider you just added.

• Group ID: Enter the group’s ID your identity provider passes in the SAML assertion. This must be an exact match with the assertion. This is case-sensitive, so eon viewers and Eon viewers are different groups.

  Okta uses the group’s name as the group ID.

• Label: Optionally, give the group a display name so it’s more recognizable in Eon.

Then choose the roles you want to assign to the group. You can assign multiple roles.

Click Create.