Access & Authentication

Okta (Performance and Enterprise)

Using Okta allows you to set up a direct link from your Okta dashboard to ProdPad. This will allow users to log in to ProdPad without having to enter a password in ProdPad.

Note

Please check your account subscription. The steps in this guide are for Performance and Enterprise accounts,  Advanced plan customers will see slightly different configuration steps, which can be seen here.

The Okta / ProdPad link supports the following capabilities:

  • Login from the Okta dashboard into ProdPad.
  • The user can also login to ProdPad via Okta if they go to https://app.prodpad.com/ .
  • Just-in-time provisioning: if a user has never logged into ProdPad before and they click on the ProdPad app in the Okta dashboard, a role will be created for them in your account. The role will have a reviewer type.
  • For Performance and Enterprise plan customers, please contact us if you wish to have your users auto-provisioned and fully managed in Okta.

Important!

If you currently have another authentication method enabled such as Google or Slack, please disable them prior to enabling Okta SSO.

In ProdPad

  1. To start go to Account Settings and select the Security tab.
  2. Now select the SSO/SAML sub-tab.
  3. Click the "Add authentication type" button and selectOkta from the dropdown.Screen_Recording_2020-05-05_at_04.11_pm.gif
  4. Keep the modal open (you will need these URLs) and go to Okta.

In Okta

  1. Go to the Applications tab in the Admin view of Okta.
  2. Click on the "Add application" button and then the "Create New App" button.
  3. In the modal select Web and SAML and click on create.
  4. Add "ProdPad" as the name and upload the logo (available at the bottom of the page) and then hit next.
  5. On the next page, in the Single sign on URL, copy & paste the ACS/Reply URL from ProdPad (https://api.prodpad.com/api/v2/sso/saml/acs)
  6. In the Audience URI, copy & paste the Audience/Identifier URL from ProdPad (https://api.prodpad.com/api/v2/sso/saml/metadata)
  7. Select the option "EmailAddress" from the Name ID format select box.
  8. Select the option "Email" from the Application username select box.
  9. In the attributes section add an attribute "User.FirstName" and set the value to "user.firstName"
  10. Add another attribute "User.LastName" and set the value to "user.lastName"
  11. Click the green next button.
  12. Click next again.
  13. Click the "View setup instructions" option.

In ProdPad

  1. Click the Next button on the Okta modal.
  2. Copy into the field labelled "IdP Entity ID/URL" in ProdPad, the URL from the field "Issuer URL" in Okta.
  3. Copy into the field "IdP SAML Single Sign-On URL" in ProdPad, the URL in the field "SAML 2.0 Endpoint" in Okta.
  4. Copy into the field "Logout URL" in ProdPad, the URL in the field "SLO Endpoint" in Okta.
  5. Paste the text of X.509 certificate (public key generated above) into the X.509 certificate field.Image_2020-05-04_at_2.04.13_pm.png
  6. If you have multiple accounts on your ProdPad plan you can select these in the Associate Accounts field - Note: you must be a user in an account before you can associate it to the authentication type.Image_2020-05-01_at_5.17.31_pm.png
  7. Now you must decide whether you want your users to login by IdP initiated login only or by IdP and SP initiated login. If you select IdP only, you user must login from the Okta dashboard, rather than the ProdPad login page. If you opt for IdP & SP initiated login you must set up the Domains that your users can login from, more about this here.
  8. If you have opted for IdP only, hit save and you are done! Your users can now use the ProdPad app link on their Okta dashboard.
  9. If you have opted for IdP & SP initiated login, from the Domains list select the domain that corresponds to the email address they will be login in from. Note: for a domain to appear as an option here in must be verified under the Domains tab.Image_2020-05-01_at_5.33.21_pm.png
  10. Hit save.

To test you can now go to the Identity providers console and click on the ProdPad app icon and you'll be logged into ProdPad. If you have configured for You can also go to to https://app.prodpad.com/login and enter your email. You'll then be shown a button to login using Okta.

Just In Time Provisioning 

In Okta, navigate to Directory > Profile Editor:

Search for the prodpad app, then click Profile:

Click Add Attribute, then enter the following information:

  • Display Name: Enter ProdpadRole.

  • Variable Name: Enter ProdpadRole.

Click Save:

If you check User personal, the ProdpadRole attribute will be available once you assign a single user to the ProdPad app and will not be available once you assign a group to the ProdPad app. For example, in the following screenshot, the User personal Scope was not applied to the ProdpadRole attribute:

 prodpad_d.png

Now, when you assign users to the ProdPad app, you can specify the attribute ProdpadRole for a user.The value needs to be either reviewereditor, or admin (lower case). If the role is not specified a user will log into as a Reviewer.

prodpad_e.png

Important!

  • The domain you enter into the form must match the email domain that you are using for your own role in ProdPad. If it doesn’t match it will error.
  • Each user will need to have an email that matches the entered domain otherwise they will get a "Miss-matched email" error when trying to log in.

Comments