How to create an Okta SAML App Integration for MVP One

1. In the Okta admin interface, navigate to Applications and select “Create App  Integration” 
   
   
   

   Click to Zoom
    
   
    
2. Select “SAML 2.0” as the sign-in method 
   
   
   

   Click to Zoom
    
   
    
3. Name the app as desired and optionally upload a logo 
    
4. Use the following SAML settings:
   1. Single sign on URL:  
      https://[site-name].mvpplant.com/v2/Login/SamlConsume?mobilecmms=true 
      This can be confirmed in MVP One under Administration > Settings > Company in the SAML section (See step 9 screenshot)
   2. Audience URI: mvpplant
   3. Name ID format: EmailAddress
   4. Application username: Email
   5. Show Advanced Settings:
      1. Other Requestable SSO URLs: https://[site-name].mvpplant.com/v2/Login/SamlConsume
   1. Attribution Statements:
      1. Name: emailAddress
      2. Name format: Basic
      3. Value: user.email (select from drop-down) Completed SAML settings should look like this: 
         
         

         Click to Zoom
          
          
5. Select the type of app as internal app.  Click Finish 
   
   
   

   Click to Zoom
    
   
    
6. You should now be in the Sign On tab of the MVP One app settings.  Scroll down to SAML Signing Certificates section and download the SHA-2 certificate.  Then, click the View SAML setup instructions link to the right of this section. 
   
   
   

   Click to Zoom
    
   
    
7. Copy the following links for use in the following steps: 
   Identity Provide Single Sign-On URL, Identity Provider Issuer 
   
   
   

   Click to Zoom
    
   
   
   
    
8. Log into MVP One> Select Administration and navigate to Settings > Company.
   
    
   
    
9. In the Authentication and SAML sections, use the following settings:
   1. Single Sign-On Authentication Type: SAML (select from drop-down)
   2. Provider Endpoint URL: Paste Identity Provider Single Sign-On URL from step 7
   3. Issuer ID: Paste Identity Provider Issuer from step 7
   4. Username Claim Assertion Attribute: emailAddress (case sensitive)
   5. Upload the certificate downloaded from step 6 
      
      
      
      
      Completed settings should look like this: 
      
      

      Click to Zoom
10. Click Save in the top right to save the changes 
     

Testing the Integration

To test the integration, verify the user is assigned the newly created app in Okta, otherwise they will get this message when attempting to authenticate.

Additionally, the user must have an account in MVP One whose username matches the email address associated with Okta.  The authentication type of the account must be set to SAML Authentication.

The user can attempt SSO authentication either directly from the MVP One login screen or by opening the application from Okta.  If their email matches a valid user account in MVP One, authentication should be successful.