Skip to content

Using external Okta as identity provider

You can use the Okta Org2Org integration to authenticate and optionally provision users from a source Okta org to a target org. The integration is installed and configured in the source org. You can use Okta Org2Org to connect multiple source orgs to a single Okta target org. This integration enables the source orgs to push users to the target org.

A common scenario where Org2Org is used is the hub-and-spoke model. In these scenarios, the spoke orgs are the source orgs and the hub org is the target org.

Source: https://help.okta.com/en-us/content/topics/provisioning/org2org/org2org-integrate.htm

Architecture

Image

Process overview

1, SAML IdP setup (Chemaxon)

This is the start of the "hub" or target Okta configuration, i.e. Chemaxon's production Okta tenant (sometimes called "Customer Okta", but not to be confused with the Customer's own Okta tenant).

Chemaxon system administrators set up the integration in Chemaxon OKTA side (as the Identity Provider of Chemaxon Cloud).

The below URLs are forwarded to the Customer

  • Assertion Consumer Service URL (Hub ACS URL)
    • Since Chemaxon has a custom brand, instead of chemaxon.okta.com, the url should start with auth.cloud.chemaxon.com, so a valid url will look something like this:https://auth.cloud.chemaxon.com/sso/saml2/<identity-provider-id>
  • Audience URI

2, Okta Org2Org application (Customer)

This is the spoke part of the hub-and-spoke configuration, or in other words, source Okta. The Customer, in their own Okta tenant, adds an Okta "Org2Org" application. The suggested name should be "Chemaxon Cloud" or "Chemaxon Cloud (Staging)", as appropriate.

Users on Customer side will need to be allocated to this application in order for the integration to work. The details of this belong to the Customer's IT, but our recommendation would be to create an Okta group, assign this group to the Org2Org application, and then assign users to this group as appropriate.

SAML application instructions

  • Open Okta Admin dashboard
  • Select Applications → Applications → Browse Catalog
  • Search for and find "Okta Org2Org", and click Add Integration

General settings

  • Enter application label: Chemaxon Cloud or Chemaxon Cloud (environment name)
    • Base URL: https://okta.chemaxon.com/
  • Application visibility: leave off
  • Click next

Sign-on options

  • Sign-on methods: change to SAML 2.0
  • Under the SAML 2.0 box, there will be an area with the text "SAML 2.0 is not configured until you complete the setup instructions." Click the "View Setup Instructions" button.
  • The Customer does not have to follow and perform the instructions on the page that opens. There are three pre-populated fields, however, that will need to be forwarded to Chemaxon. Scroll down to the "Configure SAML Protocol Settings". From here, copy/download and forward the following pieces of information to Chemaxon:
    • IdP Issuer URI (text)
    • IdP Single Sign On URL (text)
    • IdP Signature Certificate (file)
  • Advanced Sign-on Settings
    • Hub ACS URL (Assertion Consumer Service URL) - as provided by Chemaxon
    • Audience URI - as provided by Chemaxon
  • Click "Save"

3, Final configuration (Chemaxon)

Chemaxon system administrators set up the received URLs and certificates in Chemaxon OKTA, completing the configuration.

As soon as it has been finished, it can be tested by logging in to one of the Chemaxon products in your Chemaxon Cloud tenant.

This leads to both Chemaxon's Okta and the Customer's Okta being available on the login screen.