Single Sign-On with Okta

Step 1: Open the Single Sign-On Settings

1. In the CloudQuery Platform sidebar, click on your user profile, then select Organization settings.
2. Under Organization, in the Users & access group, click Single sign-on.
   • The values that CloudQuery gives to your identity provider use the domain you host CloudQuery Platform on, such as https://cloudquery.example.com.

Step 2: Create a SAML Application in Okta

1. In a new tab, log in to your Okta Admin Console.
2. Navigate to Applications → Applications.
3. Click Create App Integration.
4. Select SAML 2.0 as the sign-in method and click Next.

Step 3: Configure SAML Settings

In the General Settings section, enter CloudQuery as the App name, upload a logo (optionally) and click Next.

Under SAML Settings, enter the following:

Copy both URLs from Map information in Identity Provider on the CloudQuery single sign-on settings page:

• Single sign-on URL (ACS URL): the Single sign-on URL value.
• Audience URI (Entity ID): the Audience URI (SP Entity ID) value.
• Name ID Format: Select EmailAddress.

Scroll down to Attribute Statements and add the following:

• first_name → user.firstName
• last_name → user.lastName
• email → user.email

Then, click on Next.

Step 4: Assign Users and Groups

1. In the Assignments section, select Skip group assignment for now or assign users as needed.
2. Click Finish.
3. Navigate to the Assignments tab of the CloudQuery application in Okta.
4. Click Assign → Assign to People or Assign to Groups and select users or groups.

Step 5: Configure Metadata and Sign-Out URL

In the newly created application, go to the Sign On tab.

Then, under Settings, find the Identity Provider metadata link and copy the Metadata URL.

On the CloudQuery single sign-on settings page, under Map information from Identity Provider, select URL and paste the metadata URL into the URL field instead of uploading a metadata file. Then, locate the Sign-Out URL in Okta and copy it.

Paste the Sign-Out URL into the Logout URL field to ensure proper logout functionality.

Step 6: Enable and Test SSO

1. On the CloudQuery single sign-on settings page, turn on Enable single sign-on in the Single sign-on status card at the top of the page.
2. The switch is part of the form, so nothing is stored until you submit it. The button at the bottom of the page now reads Save and enable. Click it to save the configuration and turn single sign-on on.
3. In the Okta Admin Console, click Sign On → Test Sign In.
4. If everything is configured correctly, you can log into CloudQuery Platform with your Okta credentials.

Next Steps

• Map Groups to Roles - Map Okta groups to platform roles
• Certificate Rollover - Manage certificate updates
• User Management - Manage users and roles