Skip to content

Using Entra ID as identity provider

1, SAML IdP instructions (Chemaxon)

First, Chemaxon system administrators set up the integration in Chemaxon OKTA side (as the Identity Provider of Chemaxon Cloud).

The below URLs are forwarded to the Customer

  • Assertion Consumer Service URL (Hub ACS URL)
    • Since Chemaxon has a custom brand, instead of chemaxon.okta.com, the url should start with auth.cloud.chemaxon.com, so a valid url will look something like this:https://auth.cloud.chemaxon.com/sso/saml2/<identity-provider-id>
  • Audience URI

2, SAML application instructions (Customer)

In Customer Entra ID, the following configuration should be implement, to make the appropriate connection between Chemaxon Cloud OKTA:

  • Open Entra ID directory
  • On the left pane click "Enterprise apps"
  • On the top bar click "New application"
  • On next screen:
    • Click "Create your own application"
    • Set name for the application (for this example, this will be "CXN_Product")
    • Select "Integrate any other application you don't find in the gallery (Non-gallery)"
    • Click "Create"
  • On the overview screen of the newly created application:
    • click "Single sign-on" on the left pane
    • Select "SAML"
  • On the "SAML-based Sign-on" screen:
    • On "Basic SAML Configuration" panel, click "edit"
    • For "Identifier (Entity ID)" set the value of "Audience URI" as provided by Chemaxon
    • For "Reply URL" set the value of "Assertion Consumer Service URL" as provided by Chemaxon
    • Click "Save"
  • On the "SAML Certificates" panel:
    • Click "Download" link for "Certificate (Base64)" and send back to Chemaxon
  • On the "Set up your application name" (for this example it's "Set up CXN_Product") panel:
    • record the values below and send back to Chemaxon:
      • Login URL
      • Microsoft Entra Identifier
  • On the overview screen of "CXN_Product" application:
    • click "Users and groups" on the left pane
    • On Top bar click "Add user/group"
    • Assign users who need access to the application

3, Final configuration (Chemaxon)

Chemaxon system administrators set up the received URLs and certificates in Chemaxon OKTA, completing the configuration.

As soon as it has been finished, it can be tested by logging in to one of the Chemaxon products in your Chemaxon Cloud tenant.

Important notes

  • After doing changes in the Single sign-on attributes, new certificate needs to be downloaded and transferred to Okta
  • Okta Mapping
    • External name of Attribute is the path in the SAML assertion for example "login.login"
  • Required properties for Okta:
    • email
    • firstName
    • lastName
  • Flow of user profile attributes is:
    1. Entra > Claims > Setup name and source attribute AND don't set namespace
    2. Create Custom attribute for the field (different external name if source attribute has a namespace)
    3. Set Mapping from attribute to userProfile value
  • When creating Identity Provider:
    • Authentication Settings "IdP Usage" is very important: This value will select where will Okta look for the Unique Id of the User in the SAML Response