Okta SSO setup

Superblocks single sign-on (SSO) with Okta lets your team seamlessly authenticate and access Superblocks using their Okta credentials. Optionally, you can also let users sign in from the Superblocks tile on their Okta dashboard (IdP-initiated login). This guide walks you through how to configure single sign-on for Superblocks.

Prerequisites

To setup SSO for your organization, you’ll need:

• An Okta account
• A user account with App Admin access
• A Superblocks organization on the Enterprise plan
• Your instance’s {tenant} value. See Instance URLs

Set up Okta

Set up single sign-on for Okta by creating either a custom SAML or OIDC application. For full details, see Okta’s guides for how to:

• Create SAML app integrations
• Create OIDC app integrations

Create an OIDC integration

1. Log in to Okta and go to the Admin Console
2. Navigate to Applications → Applications
3. Click Create App Integration
4. Select OIDC - OpenID Connect as the Sign-on method
5. Select Web Application as the Application type and click Next
6. Configure the following settings for your application

   Name	Superblocks, or a custom name you want users to see on their application dashboard.
   Grant type	Authorization Code (selected by default), Refresh Token, and Implicit (hybrid)
   Sign-in redirect URIs	https://login.superblocks.com/login/callback
   Sign-out redirect URIs
   Assignments	Your desired settings for who can access Superblocks.

7. Click Save. You’ll be brought to the General tab of your new application.
8. Allow the offline_access scope
9. (Optional) To enable IdP-initiated login, so users can open Superblocks from the tile on their Okta dashboard, go to the General Settings section, click Edit, and configure the following Login settings. Skip this step if users will only sign in from Superblocks.

   Login initiated by	Either Okta or App
   Application visibility	Display application icon to users
   Login flow	Redirect to app to initiate login (OIDC Compliant)
   Initiate login URI

10. If you changed the Login settings, click Save. Then continue to find out what info to send to Superblocks.

Allow the offline_access scope

Superblocks requests the offline_access scope so that Okta issues a refresh token at login. Superblocks uses it to get a new Okta token when the one from login expires, so users don’t have to log out and back in. How you allow offline_access depends on which Okta authorization server issues tokens for Superblocks.

• Org authorization server (the default for this setup, with endpoints under https://{yourOktaDomain}/oauth2/v1/): offline_access is allowed once the Refresh Token grant type is enabled. No other changes are needed.
• Custom authorization server (for example, https://{yourOktaDomain}/oauth2/default):
  1. Go to Security → API → Authorization Servers and open the authorization server
  2. On the Scopes tab, confirm the offline_access scope exists. It’s a reserved scope that Okta creates by default, so restore it if it has been deleted.
  3. On the Access Policies tab, open the policy assigned to your Superblocks application and edit its rule
  4. Under Scopes requested, select Any scopes, or select The following scopes and include offline_access along with openid, profile, and email
  5. Click Update rule

Create a SAML integration

1. Log in to Okta and go to the Admin Console
2. Navigate to Applications → Applications
3. Click Create App Integration
4. Select SAML 2.0 as the Sign-on method
5. Provide the general information for the integration. (Optional) To enable IdP-initiated login, so users can open Superblocks from the tile on their Okta dashboard, leave Do not display application icon to users unchecked. Click Next
6. Enter the following information into SAML Settings → General

   Single sign-on URL	https://login.superblocks.com/login/callback?connection=<CompanyName>-SAML
   Audience URI	urn:auth0:superblocks-prod:<CompanyName>-SAML
   Name ID format	EmailAddress
   Application username	Email

7. Configure the follow attributes in SAML Settings → Attribute Statements

   Name	Name format	Value
   email	Unspecified	user.email
   givenname	Unspecified	user.firstName
   surname	Unspecified	user.lastName

8. Click Next and fill out the Okta feedback form, then click Finish.
9. You’ll be brought to the Sign on tab of your new application. Click View Setup Instructions and continue to the next section to learn what info to send to Superblocks.

Send IDP info to Superblocks

OIDC application

Send the following information to support@superblocks.com. On Managed BYOC, send it to your Superblocks deployment team instead.

Client ID	The public identifier for your client located on the General tab of your application.
Client Secret	The secret value shows in the CLIENT SECRETS section. Note: we recommend using a secure transfer mechanism such as https://onetimesecret.com or similar to send the secret.
Okta domain	Your company’s Okta domain. You can find this by clicking your username in the upper-right corner of the Admin Console. Learn more about how to Find your Okta domain.
Domains	A list of domain and domain aliases your employees should be able to use when logging into Superblocks.

SAML application

Send the following information to support@superblocks.com. On Managed BYOC, send it to your Superblocks deployment team instead.

Sign In URL	The Identity Provider Single Sign-On URL in the Okta setup instructions.
X509 Signing Certificate	The certificate downloaded from the setup instructions.
IdP-initiated login (optional)	Only if you want users to open Superblocks from the tile on their Okta dashboard: let us know, and Superblocks enables IdP-initiated login for your connection so the tile signs users in to your Superblocks instance.
Metadata URL (optional)	Optionally, send us the Metadata URL shown on the Sign on tab of your application.
Domains	A list of domain and domain aliases your employees should be able to use when logging into Superblocks.