How to configure Okta for Assembled

Requirements

In order to proceed with configuring login with SSO through Okta, you must:

• Have access to an Okta tenant.
• Be an Okta administrator to that tenant.
• Have an Assembled-provisioned company account.

If you do not have an Assembled-provisioned company account, please email support@assembled.com to request an invite.

Configuration Steps

The following documents the configurations for setting up the OIDC integration between Assembled and Okta. Okta is the Identity Provider (IDP) and depending on the use case, the user will be redirected to Okta for authentication if no session has been established.

Configuring the initial integration

To configure your provisioning settings for Assembled in Okta, you will need to follow the steps below:

Retrieve credentials from Okta

1. Login to your organization’s Okta tenant.
2. Navigate to Applications > Applications > Browse App Catalog, search for Assembled, and then click Add.
3. Enter an Application Label in General Settings. This is the name under which the Assembled app will appear in your Okta dashboard.
4. Click Done.
5. Then under the Sign On tab of the Assembled application, copy down the Client ID and Client Secret.
6. Under the General tab, find the Okta Domain (or Issuer URL), which is the URL at which you are accessing your Okta tenant (https://example.okta.com), for step 3.2 below. This URL also appears in the Embed Link section. Be sure to remove everything appearing after okta.com.
7. Once you have all the information (summarized below), email it to support@assembled.com and our support team will handle your request and let you know when the integration is configured.
   1. 1. Client ID
      2. Client Secret
      3. Okta Domain
8. Create a new tile with the URL as https://app.assembledhq.com/api/okta/login?company_name=<YOUR_COMPANY_NAME_HERE> (do not include "<").
   1. Please note that the default Assembled tile in Okta does not authenticate into Assembled. You need to create a new tile bookmark using the above link. Instructions on how to do that in Okta are in this article.
   2. <YOUR_COMPANY_NAME_HERE> must be formatted like a link. For example, a company name of "My Company" would need to be formatted to my+company in the link. Use a link encoder if you want to test how the link should look.
9. You can now use that tile to log-in to Assembled.

Provisioning new users

Logging in via Okta is enabled by default. However, users must be provisioned in Assembled before their first login. To provision a user:

1. If it’s the first user: Contact the Assembled Support team at support@assembled.com and request that they provision your first account. Include your name and email as information.
2. If it’s future users:
   1. An admin must login and navigate to the People page.
   2. Click Add and then Add again.
   3. Alternatively, you can click on Import from CSV or add from your connected integration if you are provisioning a lot of users.
   4. Fill in the requisite information and then click Add person.
   5. Leave the option to send an invite email unchecked.

Congrats! You've provisioned a user who can now log-in via Okta!

SP-Initiated SSO

1. Go to https://app.assembledhq.com/login.
2. Click Sign in with Okta.
3. Enter the company name provided to you from support@assembled.com.

Supported Features

The Okta SAML integration currently supports the following features:

• SP-initiated SSO.

For more information on the listed features, visit the Okta Glossary.