Integrate Omnissa Identity Service with Okta

After enabling Omnissa Identity Service in Omnissa Connect, set up the integration with Okta.

1. In the Omnissa Identity Service Getting Started wizard, click Start in step 2, Integrate a SCIM 2.0-Based Identity Provider.

2. Click Set Up on the Okta card.

   

3. Follow the wizard to set up the integration with Okta.

Step 1: Create a Directory

As the first step in setting up user provisioning and identity federation with Omnissa Identity Service, create a directory in the Omnissa Connect console for users and groups provisioned from Okta.

Caution: After you create a directory, you cannot change your identity provider selection. Make sure that you select the appropriate identity provider before proceeding.

Procedure

1. In step 1, General Information, of the wizard, enter the name that you want to use for the provisioned directory in Omnissa Identity Service.

   The name can have a maximum length of 128 characters. Only the following characters are allowed: letters (a-z or equivalent in other languages), digits (0-9), space, hyphen (-), and underscore (_).

   Important: You cannot change the name of the directory after it is created.

2. For Domain Name, enter the primary domain name of your source directory, including the extension such as .com or .net.

   Omnissa Identity Service currently supports only one domain. Provisioned users and groups are associated with this domain in Omnissa services.

   The domain name can have a maximum length of 100 characters. Only the following characters are allowed: letters (a-z or equivalent in other languages), digits (0-9), space, hyphen (-), underscore (_), and period (.).

   For example:

   

3. Click Save, and confirm your selection.

What to do next

Set up user and group provisioning.

Step 2: Set up User and Group Provisioning

After you create a directory in Omnissa Identity Service, set up user and group provisioning. You start the process in Omnissa Identity Service by generating the admin credentials required for provisioning, then create a provisioning app in Okta to provision users and groups to Omnissa Identity Service. The Okta Integration Network includes the Omnissa Identity Service app for you to use.

Prerequisites

You have an administrator account in Okta with the privileges required to set up provisioning.

Procedure

1. In the Omnissa Connect console, after creating a directory, review and copy the values generated in step 2, Configure Identity Provider, of the wizard.

   You require these values to configure the provisioning app in Okta.

   • Omnissa Base Url: Your Omnissa Identity Service tenant's URL. Copy the value.

   • Token Lifespan: The period for which the secret token is valid.

     By default, Omnissa Identity Service generates the token with a lifespan of six months. To change the token lifespan, click the down arrow, select another option, and click Regenerate to regenerate the token with the new value.

     Important: Whenever you update the token lifespan, the previous token becomes invalid and provisioning of users and groups from Okta fails. You must regenerate a new token and copy and paste the new token to the Okta app.

   • Secret token: The token required by Okta to provision users to Omnissa Identity Service. Copy the value by clicking the copy icon.

     Important: Make sure you copy the token before clicking Next. After you click Next, the token will no longer be visible and you will have to generate a new token. If you regenerate the token, the previous token becomes invalid and provisioning fails. Make sure that you copy and paste the new token to the Okta app.

   For example:

   

   When the token is about to expire, a banner notification will appear in Omnissa Identity Service. If you also want to receive email notifications, make sure that you opt in to receive emails. See How to enable email notifications.

2. Create the provisioning app in Okta.

   1. Log into the Okta Admin console.

   2. In the left navigation pane, select Applications > Applications.

   3. Click Browse App Catalog.

   4. Search for and select the Omnissa Identity Service app.

      

   5. Click Add Integration.

      

   6. In the General Settings tab, enter the following values:

      • Application label: Enter a name for the app.
      • Omnissa Base Url: Copy and and paste the Omnissa Base Url value from the Omnissa Identity Service wizard into the text box.
      • Application Visibility: Select the Do not display the application icon to users check box because the app is not intended to be used for IdP-initiated flows.

      For example:

   7. Click Done.

   8. Select the Provisioning tab and configure it.

      1. Click Configure API Integration.

         

      2. Select the Enable API integration check box.

      3. Deselect the Import Groups check box.

      4. Copy the Secret Token value from the Omnissa Identity Service wizard and paste it into the API Token text box.

      5. Click the Test API Credentials button to test the connection.

         

      6. Make sure you see the Omnissa Identity Service was verified successfully! message before proceeding.

      7. Click Save.

         The Provisioning to App page appears.

   9. In the Provisioning to App page, click Edit and select Enable for the following options:

      • Create Users
      • Update User Attributes
      • Deactivate Users

   10. Click Save.

What to do next

Return to the Omnissa Connect console to continue with the Omnissa Identity Service wizard.

Step 3: Map SCIM User Attributes

In the Okta Admin console, map the user attributes to synchronize from Okta to Omnissa services. Many attributes, including required ones, are already mapped in the Omnissa Identity Service app. You can edit the mappings and add new ones. At a minimum, you must synchronize the attributes required by Omnissa Identity Service and the Omnissa services integrated with it.

Attributes required for Workspace ONE UEM and Omnissa Access

The following SCIM user attributes are required:

Okta Attribute	SCIM User Attribute (Required)
userName	userName
user.email	email
emailType	(user.email != null && user.email != '') ? 'work' : ''
user.firstName	name.givenName
user.lastName	name.familyName
externalId	externalId Note: This attribute is set implicitly. You do not need to add it manually.
active	active Note: This attribute is set implicitly. You do not need to add it manually.

Note: The table shows the typical mapping between the required SCIM attributes and Okta attributes. You can map the SCIM attributes to different Okta attributes than those listed here.

For more information about these attributes and their mapping to Workspace ONE attributes, see User Attribute Mapping for Omnissa Identity Service.

In addition to the required attributes, you can synchronize optional attributes and custom attributes. For the list of supported optional and custom attributes, see User Attribute Mapping for Omnissa Identity Service.

Important: You cannot specify group attribute mappings in Okta to synchronize to Omnissa Identity Service. You can only map user attributes.

Attributes required for Horizon Cloud

See Using Omnissa Identity Service with Horizon Cloud for the list of SCIM user attributes required for Horizon Cloud.

Procedure

1. In the Omnissa Connect console, in step 3, Map SCIM User Attributes, of the Omnissa Identity Service wizard, review the list of attributes that Omnissa Identity Service supports.

2. In the Okta Admin console, navigate to the provisioning app you created for user provisioning to Omnissa Identity Service.

3. Select the Provisioning tab.

4. Scroll to the AppName Attribute Mappings section.

   The most common attributes, including the required attributes, are already mapped. For example:

   

5. To edit the mappings or map other attributes, follow these steps.

   1. Click Go to Profile Editor.

   2. In the Profile Editor page, under Attributes, click Mappings.

      

   3. Select the Okta User to AppName tab.

      

   4. Map the Okta attributes to the Omnissa Identity Service attributes (SCIM attributes).

   5. To add custom attributes, map the Okta attributes to the Omnissa Identity Service attributes (SCIM attributes) named customAttribute#.

      Omnissa Identity Service supports up to five custom attributes.

   6. Click Save Mappings.

   7. Click Apply Updates Now.

What to do next

Return to the Omnissa Connect console to continue with the Omnissa Identity Service wizard.

Step 4: Select the Authentication Protocol

Select the protocol to use for federated authentication. Omnissa Identity Service supports the OpenID Connect and SAML protocols.

Caution: Make your choice carefully. After you select the protocol and configure authentication, you cannot change the type of protocol without deleting the directory.

Requirements for certain username and password-based flows in Workspace ONE UEM (Password Grant flows)

If you plan to use Workspace ONE UEM username and password-based flows that rely on the Password Grant protocol, you must select OpenID Connect as the authentication protocol in Omnissa Identity Service.

You must also enable the Password Grant setting on the Workspace ONE UEM Directory Services page to grant permission to use the legacy Password Grant protocol. See Configure Workspace ONE UEM Settings for Omnissa Identity Service.

For the list of flows to which these requirements apply, see Support for Certain Workspace ONE UEM Username and Password-based Flows.

Procedure

1. In step 4, Select Authentication Protocol, of the wizard, select OpenID Connect or SAML.

2. If you plan to create Basic users in Workspace ONE UEM, expand Setup UEM Basic User Authentication and enable the Basic user authentication for UEM option.

   See Configuring Authentication for Workspace ONE UEM Basic Users for information.

3. Click Next.

   The next step of the wizard appears with the values required to configure the protocol you selected.

What to do next

Configure Omnissa Identity Service and Okta for federated authentication.

Step 5: Configure Authentication (Okta)

To configure federated authentication with Okta, you set up an OpenID Connect or SAML app in Okta using the service provider metadata from Omnissa Identity Service, and configure Omnissa Identity Service with the values from the app.

Important: Make sure that you create separate apps in the Okta Admin console for user provisioning and identity provider configuration. You cannot use the same app for provisioning and authentication.

OpenID Connect

If you selected OpenID Connect as the authentication protocol, follow these steps.

Also see the Okta documentation, Create OIDC app integrations, for additional information and to refer to the latest user interface.

Procedure

1. From step 5, Configure OpenID Connect, of the Omnissa Identity Service wizard, copy the Redirect URI value.

   You need this value for the next step, when you create an OpenID Connect application in the Okta Admin console.

   

2. Create an OpenID Connect app in Okta.

   1. In the Okta Admin console, select Applications > Applications in the left pane, then click Create App Integration.

   2. In the Create a new app integration window, select OIDC - OpenID Connect.

   3. For Application type, select Web Application, then click Next.

      Note: If you plan to enable Workspace ONE UEM flows that use the Password Grant protocol for authentication, select Native Application instead of Web Application. (For the list of flows, see Support for Certain Workspace ONE UEM Username and Password-based Flows.)

   4. In the New Web App Integration page, specify the following values.

      App integration name: Enter a name for the app.

      Grant type: Select Authorization Code.
      Note: If you plan to enable Workspace ONE UEM flows that use the Password Grant protocol for authentication, select Resource Owner Password in addition to Authorization Code.

      Sign-in redirect URIs: Copy and paste the Redirect URI value that you copied from Step 5 of the Omnissa Identity Service wizard.

      Assignments - Controlled Access: You can choose to assign the app to a group now, or make assignments later.

      For example:

      

   5. Click Save.

3. Find the client ID and client secret of the Okta OpenID Connect app.

   1. Select the General tab.

   2. Find the Client ID and Client Secret values.

      

   You will use these values in the next step.

4. Return to the Omnissa Identity Service wizard in the Omnissa Connect console, and complete the configuration in the Configure OpenID Connect section.

   Client ID	Copy and paste the Client ID value from the Okta OpenID Connect app.
   Client Secret	Copy and paste the client secret value from the Okta OpenID Connect app.
   Configuration URL	Copy and paste the OpenID Connect well-known configuration URL of the Okta app. For example: https://yourOktaOrg/.well-known/openid-configuration
   OIDC User Identifier Attribute	Specify the OpenID Connect attribute to map to the Workspace ONE attribute for user lookups.
   Workspace ONE User Identifier Attribute	Specify the Workspace ONE attribute to map to the OpenID Connect attribute for user lookups.

   

5. Click Finish to complete setting up the integration between Omnissa Identity Service and Okta.

SAML

If you selected SAML as the authentication protocol, follow these steps.

For the SAML configuration, use the Omnissa Identity Service provisioning app that you created in Step 2: Set up User and Group Provisioning.

Note: SAML apps in the Okta Integration Network, including the Omnissa Identity Service app, do not support encrypting assertions or uploading an encryption certificate. If you require encryption, create a new custom SAML app instead of using the Omnissa Identity Service app. For information on creating a custom app, see the Okta documentation Create SAML app integrations.

Procedure

1. Configure the Okta app and get the federation metadata.

   1. In the Okta Admin console, select Applications > Applications.

   2. Search for and select the provisioning app you created in Step 2: Set up User and Group Provisioning.

   3. Select the Sign On tab of the app.

   4. In the Settings - Credentials Details section, set Application username format to Okta username.

   5. From the Settings - SAML 2.0 - Metadata details section, copy the Metadata URL for use in the next step.

2. In the Omnissa Connect console, in step 5 of the Omnissa Identity Service wizard, paste the Okta metadata in the Identity provider metadata text box.

   

3. In the Omnissa Connect console, configure the rest of the options in the Configure SAML Single Sign-On section, as needed.

   • Binding protocol: Select the SAML binding protocol, HTTP POST or HTTP Redirect.
   • Name ID format: The Name ID format is always urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified.
   • Name ID value: Select userName.

   Advanced options

   • Send Subject in SAML request (when available): Select this option if you want to send the subject to the identity provider as a login hint to improve the user login experience, when available.
   • Use SAML single logout: Select this option if you want to log users out of their identity provider session after they log out of Omnissa services.
   • Identity provider single logout URL: If your identity provider does not support SAML single logout, you can use this option to specify the URL to which to redirect users after they log out of Omnissa services. If you use this option, also select the Use SAML single logout check box.
     If you leave this option blank, users are redirected to the identity provider using SAML single logout.
   • Encryption certificate: Upload this certificate to the Okta SAML app if you plan to enable SAML encryption in Okta.
     Note: Okta supports encryption certificates for custom SAML apps only. You cannot upload the certificate to the Omnissa Identity Service app.

4. Click Finish to complete setting up the integration between Omnissa Identity Service and Okta.

Results

The integration between Omnissa Identity Service and Okta is complete.

The directory is created in Omnissa Identity Service and will be populated when you push users and groups from the provisioning app in Okta. Provisioned users and groups will automatically appear in the Omnissa services that you choose to use with Omnissa Identity Service, such as Omnissa Access and Workspace ONE UEM.

You cannot edit the directory in the Omnissa Access, Workspace ONE UEM, or Horizon Cloud consoles. Directory, users, user groups, user attributes, and identity provider pages are read-only.

What to do next

Next, select the Omnissa services to which you want to provision users and groups.

If Workspace ONE UEM is one of the services you select, configure additional settings in the Workspace ONE UEM console.

Then, push users and groups from Okta. See Provisioning Users to Omnissa Identity Service.