Okta and Nebula single sign-on configuration

The following instructions assist the Identity Provider administrator with the setup of single sign-on (SSO) for Nebula with Okta. Nebula only supports SAML 2.0 authentication protocol. 

Get started

• The email address used for the Nebula account must match the email address used for Okta.
• Log in to Nebula and go to Configure > Single Sign-on.
• Log in to your Okta Administrator portal and go to the Admin > Applications page.

Add the application in Okta - General Settings

1. From the Applications page in Okta, click Create App Integration.
2. In the Create a New App Integration dialog that opens, select SAML 2.0 and click Next.
3. Name the app in the App name field and click Next.

Setup Okta SAML Settings

1. In the Nebula Single Sign-On page, copy the Assertion Consumer Service URL.
2. Paste the copied url into the Single sign on URL field in Okta.
3. On the Nebula Single Sign-On page, copy the Service Provider Entity ID.
4. Paste the copied url into the Audience URI (SP Entity ID) field in Okta.
5. Leave Default RelayState field blank.
6. Set Name ID format field to Unspecified.
7. Set Application username field to Email.
   
8. Leave update application username on Create and update.
9. (A) Type email in the Name field > (B) set Name format to URI Reference > (C) type user.email in the Value field, in lowercase, exactly as displayed below.
   
10. Click Next.
11. Click Finish.

Upload Okta SSO XML file into Nebula

1. You'll land on the Sign On tab of the new application you've created. On the right-side, click View SAML setup instructions.
   
2. Scroll down to Optional at the bottom.
3. Copy the IDP metadata.
   
4. Paste it into a new file.
5. Save the file as an XML file. 
6. In the Nebula Single Sign-On page, have a Nebula Super admin drag the .xml file or Choose a Different File to upload the Identity Provider (iDP) Metadata.

Enable SSO

1. Once the metadata is uploaded, toggle on Enable SSO.
   • Toggle on Just-In-Time (JIT) Provisioning to automatically create Nebula users if they don't already exist when authenticating through Okta.
   • Toggle on Service Provider Initiated SSO if you will be accessing Nebula through a tile or button in Okta.
2. Now the application can be assigned to your Nebula administrators in Okta.