Introduction
This article shows how to sync Open ID Connect (OIDC) groups and roles with the Astrato enterprise authentication function.
Syncing groups and roles helps centralize security in OIDC and manage all access to data and features in Astrato from OIDC.
We're using OKTA as an example.
Contents
Setup Information
The setup process has several stages, so we've listed them here. In the instructions for each stage, we've included a Checklist listing any information you need to enter and any information you'll need to collect to complete the setup.
OKTA - You'll need to set up your OKTA workspace using the admin console app integration wizard, and generate a Client ID and Client secret to add in Astrato.
Astrato—The Astrato setup is managed in the Open ID Connect Setup page in the Enterprise Authentication section of the Administration pages. You'll need to enter a Connection Name, Issuer URL, Client ID, Client Secret, and Identity provider domain.
OKTA Settings
Checklist
Access to the OKTA Admin Console for your organization.
Roles Configuration
In OKTA, navigate to Directory ➝ Profile Editor ➝ select profile (Okta)
In the profile editor, select Add attribute
Enter a display name and variable name, check the enum checkbox, and provide values as below.
warning: display name and value needs to be in line with the names of Astrato roles
administrator
designer
viewer
creator
Save
Navigate to Directory ➝ people ➝ select user.
Click on Edit, scroll down, and select an Astrato role for the user, click Save.
Navigate to Security->API, select a server, and click Edit.
Open the Claims tab and insert these details:
Name: astrato_role
Include in token type: ID Token, Always
Value type: Expression
Value: user.astrato_role
Include in: Any scope
Save
Validate the configuration by navigating to the Token Preview tab
select OAuth/OIDC client
set grant type to Authorization Code
select a user with an astrato role
scope: openID
The Token should include an Astrato Role similar to the token below
Groups Configuration
Navigate to Directroy->Groups, create a new group, and users to the group
* If you want to sync only part of the groups with Astrato, use the same prefix for all groups' names.
Navigate to Security->API->select the authorization server you used in the roles phase.
Select the Claims tab and add a new claim. Fill in the claim with the details below:
Name: groupsInclude in token type: ID Token, Always
Value type: Groups
Include in The following scopes- openid
Save
Test the token. The token should include the groups now.
Astrato Settings
Navigate to Administration->Enterprise Connection -> Login connection
Open an existing OKTA connection or define a new connection following this article.
Check the boxes to sync the groups and roles in connection with editing.
For the roles sync, add the role attribute name from OKTA.
For the group sync, add the prefix for the groups you want to sync. If the prefix is empty, all groups from OKTA will be synced with Astrato.
Save.
Select the Controlled Access option that suits your organization best in Assignments, then click Save.