Configuring Liferay DXP as SP and OKTA as IdP

This article documents the basic steps users need to execute in order to set up their instance of Liferay DXP as SP, and OKTA as IdP.

Resolution

OKTA Configuration

1. Log in to OKTA and navigate to Admin > Add Application (Shortcuts in the right menu) > Create New App.
2. Select SAML 2.0.
3. Enter liferaysaml as the name and click next.
4. Enter the following fields:
   • Single sign on URL: http://[myipaddress]:8080/c/portal/saml/acs
   • Audience URI (SP Entity ID): samlspdemo
   • Name ID format: EmailAddress
   • Application username: Email
5. Select Attribute Statements
   • screenName (Unspecified) = user.firstName
   • firstName (Unspecified) = user.firstName
   • lastName (Unspecified) = user.lastName
   • emailAddress (Unspecified) = user.email
6. Click Next, Check the box by This is an internal application that we created > Finish
7. On the Sign On tab, confirm that Application username format is set to to Email
8. Under Sign On Methods, click View Setup Instructions button.
9. Under the Optional heading, select all the xml text and use it to create oktametadata.xml
10. Navigate to Applications -> Applications. Click on the down arrow for the liferaysaml application. Click on Assign to users, click assign for your users, then on Save and Go Back.

Liferay DXP

1. Start a vanilla Liferay DXP bundle deploy SAML 2.0 plugin, if applicable (the plugin is built into core Liferay DXP 7.3 and higher).
2. Go to Control Panel > Configuration > SAML Admin > General (or Control Panel > Security > SAML Admin in DXP 7.3+) and set the SAML Role to Service Provider, and Entity ID to samlspdemo.
3. Create certificate.
4. In Service Provider tab, keep the default settings:
   • Clock Skew: 3000
   • Sign Authn Requests? selected
   • Sign Metadata? selected
5. In Identity Provider tab, set the following:
   1. Name: okta
   2. Upload the oktametadata.xml file created previously
   3. Enter the entity ID (found in xml file as entityID)
   4. Set Name Identifier Format to Email Address
   5. Enter the following Attributes:
      • emailAddress=emailAddress
      • firstName=firstName
      • lastName=lastName
      • screenName=screenName
   6. Click on the box next to Enabled
   7. Click on Save
6. Go back to General tab and enable the Service Provider.
7. Add Sign In portlet to home page (In case the SSO is not working, administrator can sign into portal bypassing SSO).
8. Open a new browser and click top right Sign In which will redirect user to OKTA sign in page.
9. Fill in the user name and password.
10. User will be redirected back to Liferay home page and automatically sign in.