Okta SAML SSO Integration

Fiddler AuthN Console Sign-in

Sign in using the AuthN Console Org Owner user account credentials provided by your Fiddler representative:

Select Your Organization

Ensure your organization is selected in the dropdown. You may see the fiddler organization, but this is reserved for system use and should not be edited. Here we are using the example1 organization:

Navigate to Identity Providers in Settings

Select Settings tab from the top menu and then select Identity Providers from the left navigation menu:

Add and Configure New SAML Provider

1. Select the SAML option in the Add provider section which brings up the Sign in with SAML form.

2. Choose a name for the Okta SAML integration. Note that this name will be displayed on the SSO login button on the Fiddler sign-in page so choose a name your users will recognize.

3. Paste the following placeholder value into the Metadata Xml text area. This is necessary for AuthN to create the URLs needed when you create the Okta app integration. It will be replaced in a later step.

PD94bWwgdmVyc2lvbj0iMS4wIj8+DQo8bWQ6RW50aXR5RGVzY3JpcHRvciB4bWxuczptZD0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOm1ldGFkYXRhIg0KICAgICAgICAgICAgICAgICAgICAgdmFsaWRVbnRpbD0iMjAyNS0wOC0zMFQxMzo0NToxM1oiDQogICAgICAgICAgICAgICAgICAgICBjYWNoZUR1cmF0aW9uPSJQVDYwNDgwMFMiDQogICAgICAgICAgICAgICAgICAgICBlbnRpdHlJRD0iaHR0cDovL2xvY2FsaG9zdDo4MDgwIj4NCiAgICA8bWQ6U1BTU09EZXNjcmlwdG9yIEF1dGhuUmVxdWVzdHNTaWduZWQ9ImZhbHNlIiBXYW50QXNzZXJ0aW9uc1NpZ25lZD0iZmFsc2UiIHByb3RvY29sU3VwcG9ydEVudW1lcmF0aW9uPSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6cHJvdG9jb2wiPg0KICAgICAgICA8bWQ6TmFtZUlERm9ybWF0PnVybjpvYXNpczpuYW1lczp0YzpTQU1MOjEuMTpuYW1laWQtZm9ybWF0OnVuc3BlY2lmaWVkPC9tZDpOYW1lSURGb3JtYXQ+DQogICAgICAgIDxtZDpBc3NlcnRpb25Db25zdW1lclNlcnZpY2UgQmluZGluZz0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOmJpbmRpbmdzOkhUVFAtUE9TVCINCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBMb2NhdGlvbj0iaHR0cDovL2xvY2FsaG9zdDo4MDgwL2NvbnN1bWUvZGF0YSINCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpbmRleD0iMSIgLz4NCiAgICAgICAgDQogICAgPC9tZDpTUFNTT0Rlc2NyaXB0b3I+DQo8L21kOkVudGl0eURlc2NyaXB0b3I+

Create the IdP

Select the Create button. Once the page refreshes, there are four URLs displayed. These three URLs will be required in the Okta App Integration steps. The fourth URL is unused.

• ZITADEL Metadata

• ZITADEL ACS Login Form URL

• ZITADEL ACS Intent API

Create New App Integration in Okta

1. Open your Okta Admin console and navigate to the Applications page and select the Create App Integration button:

   
2. In the sign-in method modal, select SAML 2.0 and select the Next button:

   
3. Name your Fiddler instance per your company guidelines and select the Next button:

   

Configure the Okta App

1. Enter the ACS Login Form URL from Step 5 into the Single sign-on URL text box

   1. Ensure the Use this for Recipient URL and Destination URL checkbox is selected

2. Enter the Metadata URL from Step 5 into the Audience URI (SP Entity ID) text box

   
3. Enter the Metadata URL from Step 5 into the Audience URI (SP Entity ID) text box:

   
4. Expand the Advanced Settings section

5. In the Other Requestable SSO URLs section, select the + Add Another button and enter the ACS Intent API URL copied the AuthN console's identity provider page and enter 0 for the Index

   
6. In the Attribute Statements section, add the required attributes setting Name format as Basic for all entries:

   

   1. Name=firstName, Value=user.firstName

   2. Name=lastName, Value=user.lastName

   3. Name=email, Value=user.email

7. Select the Next button. No changes are required on this page

8. Select the Finish button to complete the creation of the application

9. Copy the Metadata URL value on Sign On page from the SAML 2.0 section

   

Replace the Placeholder Metadata Xml

1. Return to the Fiddler AuthN console where we left it in Step 5

2. Delete the placeholder Metadata Xml value and leave it blank

3. Paste the Metadata URL copied from Okta in the previous step into the Metadata URL text box

Configure Additional Parameters

1. Expand the optional section

2. Ensure the Automatic create and Automatic update checkboxes are selected

3. Set the Determines whether an identity will be prompted to be linked to an existing account dropdown to Check for existing Username

Save the Configuration Changes

Select the Save button and you will be returned to the Settings page for your Organization:

Activate the Okta SAML IdP

1. Select your IdP from the list that the Metadata XML field is populated. The contents were dynamically inserted from the Metadata URL.

   
2. At the top of the page, select the Activate button to enable this IdP login.

3. Select Login Behavior and Security from the left nav menu and ensure the External login allowed checkbox is selected.

   

Create a Custom Action

Select the Actions tab from the top menu

1. Select the New button in the Scripts section to create a new action script

2. Copy the Okta SAML Action Script below and paste it into the script text area

3. Enter setAttributesOnOktaSAMLAuth in the Name text box

4. Select the Add button

function setAttributesOnOktaSAMLAuth(ctx, api) {
    let firstName = ctx.v1.providerInfo.attributes["firstName"];
    let lastName = ctx.v1.providerInfo.attributes["lastName"];
    let email = ctx.v1.providerInfo.attributes["email"];
    let groups = ctx.v1.providerInfo.attributes["groups"];
    
    let nameParts = [firstName, lastName];
    let filteredParts = nameParts.filter(part => part);
	let displayName = filteredParts.join(' ');
  
    if (firstName != undefined) {
      api.setFirstName(firstName);
    }
    if (lastName != undefined) {
      api.setLastName(lastName);
    }
    if (email != undefined) {
      // Email is returned as an object in SAML response.
      // We typecast it to string before normalizing it.
      email = String(email).toLowerCase();
      api.setEmail(email);
      api.setEmailVerified(true);
      api.setPreferredUsername(email);
    }
    if (displayName != undefined) {
      api.setDisplayName(displayName);
    }
  
    api.v1.user.appendMetadata('fiddler_authentication_type', 'SSO:OKTA:SAML');
    if (groups === null || groups === undefined){
      groups = []
    }
    api.v1.user.appendMetadata('fiddler_groups', groups);
  }

Configure the Action Trigger

Scroll down to the Flows section

1. Select the + Add trigger button

2. Select the Post Authentication option for the Trigger Type dropdown

3. Select the setAttributesOnOktaSAMLAuth option for the Actions dropdown

4. Select the Save button

Validate the Integration

1. Enter your Fiddler URL. This is https://example1.dev.fiddler.ai in our example. Your Fiddler URL will vary according to your company name and the Fiddler deployment type.

2. Ensure you see the Fiddler Sign-on page and that the page displays the SSO Login - Okta SAML button:

   
3. Select the button and confirm that the Fiddler application loads: