Configure IdP

When performing authentication and login through SAML, you can refer to this section to complete federated identity verification. This chapter provides configuration steps for three types of IdPs: Okta, Microsoft Extra ID, and JumpCloud.

Okta

Prerequisites

• You have obtained the ACS URL and SP Entity ID for OB Cloud by referring to Organization authentication.
• You have obtained an Okta Admin account.

Procedure

Step 1: Create an Okta application

1. Log in to the Okta administrator environment using the Admin account.
2. In the left navigation pane, select Applications > Applications.
3. Click Create App Integration to create a new application.
4. On the Create a new app integration page, select SAML 2.0 and click Next.

Step 2: Configure SAML integration

1. The system automatically goes to the Create SAML Integration tab. In ① General Settings, configure the basic application information and click Next.

2. On the ② Configure SAML tab, complete the following configurations:

   • Single sign-on URL: Enter the ACS URL obtained in OB Cloud.
   • Audience URI: Enter the SP Entity ID obtained in OB Cloud.

   Leave other fields empty or set them to their default values, then click Next.

3. On the ③ Feedback tab, select This is an internal app that we have created and click Finish.

Step 3: Obtain the Okta source certificate and Metadata URL

The system automatically redirects to the Sign on tab of the new application. Here, you can obtain the Okta source certificate and Metadata URL, and fill them into the organization authentication configuration page of OB Cloud:

• In the Sign on methods section, copy the Metadata URL and enter it into the IdP SSO URL field in OB Cloud.
• In the SAML Signing Certificates section, find the latest certificate with a Status of Active, click Actions, and select Download certificate from the drop-down menu. Download the file locally and copy its content into the IdP X509 Certificate field in OB Cloud.

Step 4: Add users and organizations to the application

1. In the left navigation pane, select Directory > People and click Add Person.
2. In the dialog box that appears, configure the user information and click Save.
3. Return to the Assignments tab of the new application. Click Assign > Assign to people to add users to the application.
4. Select the users in the dialog box and click Done.

Microsoft Extra ID

Prerequisites

• You have obtained the ACS URL and SP Entity ID for OB Cloud by referring to Organization authentication.
• You have obtained an Admin account for Microsoft Extra ID.

Procedure

Step 1: Create a Microsoft Entra ID application

1. Log in to the Microsoft Entra admin center page of Microsoft Azure by using the Admin account.
2. In the left-side navigation pane, choose Entra ID > Enterprise apps.
3. On the All applications page, click + New application.
4. On the Browse Microsoft Entra App Gallery page, click Create your own application to create a new application.
5. In the right panel, enter a name for the new application, such as OB, and select its specific purpose. After configuration, click Create.

Step 2: Add users to the application

1. The system will default to the Overview page of the new application. In the Getting started section, click Assign users and groups on the 1.Assign users and groups card.
2. On the Users and groups page, click Add user/group.
3. On the Add Assignment page, click None Selected, select users in the right panel, and click Select. To add more users, return to the Microsoft Entra admin center page and create users via User in the left navigation bar.
4. The system will automatically redirect to the Add Assignment page. Click Assign.

Step 3: Configure SAML integration

1. Return to the Overview page of the new application. In the Getting started section, click Get Started on the 2.Set up single sign on card.
2. On the Select a single sign-on method page, click SAML.
3. On the Set up Single Sign-on with SAML page, configure the SAML-related information:
   1. In step ① Basic SAML Configuration, enter the following information:
      • Identifier (Entity ID): Enter the SP Entity ID obtained in OceanBase Cloud.
      • Reply URL (Assertion Consumer Service URL): Enter the ACS URL obtained in OceanBase Cloud.
   2. In step ③ SAML Certificates, click Download next to Certificate (Base64) to download it. Open the file and copy its content to the IdP X509 Certificate folder in OceanBase Cloud.
   3. In step ④ Set up OB, copy the Login URL and enter it into the IdP SSO URL field in OceanBase Cloud.

JumpCloud

Prerequisites

• You have obtained the ACS URL and SP Entity ID for OB Cloud by referring to Organization authentication.
• You have obtained the Admin account for JumpCloud.

Procedure

Step 1: Create a JumpCloud application

1. Log in to the JumpCloud Admin Portal as the admin user.
2. In the left navigation bar, select Access > SSO Applications.
3. Click + Add New Application to go to the Create New Application Integration page.
4. On the Select Application step, click Create a Custom Integration in the search box to create a custom application, then click Next.
5. On the Select Options step, select Manage Single Sign-On(SSO) and choose the Configure SSO with SAML mode. Then click Next.
6. On the Enter General Info step, fill in the general configuration information for the application, including the tag and application description. Then click Save Application.
7. On the Review step, confirm whether the application information is correct. If correct, click Configure Application.

Step 2: Configure SAML integration

1. The system will default to the SSO tab, where you can configure SAML integration. During the configuration process, pay special attention to the following parameters:

   Parameter	Description
   JumpCloud Metadata	Click Export Metadata to download the file. This file content is used to fill in the IdP X509 Certificate field in OB Cloud.
   SP Entity ID	Enter the IdP Entity ID obtained in OB Cloud.
   ACS URLs	Enter the ACS URL obtained in OB Cloud into the Default URL field.
   SAMLSubject NameID Format	Select urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress.
   Idp URL	Copy this URL to fill in the IdP SSO URL field in OB Cloud.
   Attributes	In the User Attributes section, click Add Attribute to add a user Attributes mapping. Service Provider Attribute Name: The name can be customized. JumpCloud Attribute Name: Select email.

2. Click Save to complete the configuration.

Step 3: Create a User and join an Organization

1. In the left navigation bar, select Identity Management > Users.
2. On the Users tab, click + Users to create a user.
3. Configure the user information and click Save User.
4. Return to the Users page. Select the users you want to join an organization with, and click Actions > Add to User Group in the upper-right corner.
5. In the dialog box, select the target organization to join. You can choose an existing organization or create a new one.

Step 4: Add an Application to an Organization

1. In the left navigation bar, select Identity Management > Users Groups.
2. On the All Groups tab, click the organization in the organization list to which you want to add an application.
3. In the right-side panel, select the Applications tab. Select the specific organization and click Save Group.