This topic describes how to create an Okta application integration that uses the Security Assertion Markup Language (SAML) 2.0 protocol and update settings of OceanBase Migration Service (OMS) to implement single sign-on (SSO).
Limitations
At present, you can configure only one server for SSO login to OMS over the SAML 2.0 protocol.
Configurations in Okta
Create an Okta application integration that uses the SAML 2.0 protocol.
Log in to the Okta console.
In the left-side navigation pane, choose Applications > Applications.
On the Applications page, click Create App Integration.
In the Create a new app integration dialog box, select SAML 2.0 and click Next.
On the General Settings page, specify App name and click Next.
On the SAML Settings page, specify the following parameters and click Next.
Parameter Description Single sign-on URL The SSO URL in the format of http://<ip>:<port>/omsp/saml/SSO. The<ip>and<port>fields correspond to the IP address and port number of the OMS endpoint, respectively.
Do not select Use this for Recipient URL and Destination URL.Recipient URL The URL of the recipient. Enter http://localhost:8090/omsp/saml/SSO.Destination URL The URL of the target. Enter http://localhost:8090/omsp/saml/SSO.Audience URI (SP Entity ID) The custom ID of the service provider (SP). The ID must be consistent with the value of the system parameter oms.auth.saml2.entity-idof OMS.On the Feedback page, click Finish.
Configurations in OMS
Modify system parameters
Log in to the OMS console with an account that has ROOT permissions.
In the left-side navigation pane, choose System Management > System Parameters.
Click the edit icon in the Value column of the parameter that you want to modify.
You need to modify the following parameters of the SSO module: oms.auth.saml2.entity-id, oms.auth.saml2.metadata-provider, oms.auth.saml2.certificate, oms.auth.sso-login-url, and oms.auth.saml2.redirect-url.
In the Modify Value dialog box, set Value.
The correspondence between the preceding OMS system parameters and the Okta SAML 2.0 application parameters is described as follows:
oms.auth.saml2.entity-id: the entity ID of OMS used in the SAML 2.0-based authentication service. The value must be consistent with that of the
Audience URI (SP Entity ID)parameter of the Okta SAML 2.0 application.oms.auth.saml2.metadata-provider: the metadata URL of the SAML 2.0-based authentication service. The value must be consistent with that of the
Metadata URLparameter of the Okta SAML 2.0 application.
oms.auth.saml2.certificate: the certificate used by OMS to verify the information returned by the SAML 2.0-based authentication service. The value must be consistent with that of the
Signing Certificateparameter of the Okta SAML 2.0 application.
oms.auth.sso-login-url: the SSO URL of OMS used in the SAML 2.0-based authentication service. The value must be consistent with that of the
Single sign-on URLparameter of the Okta SAML 2.0 application.oms.auth.saml2.redirect-url: the OMS URL to which the user is redirected after its identity is authenticated by the SAML 2.0-based authentication service. The value is in the format of
http://<ip>:<port>/oms-v2. The<ip>and<port>fields correspond to the IP address and port number of the OMS endpoint, respectively.
Click OK.
Modify system configuration
Log in to the OMS container that resides on the server whose IP address is specified by the
oms.auth.sso-login-urlparameter.docker exec -it ${CONTAINER_NAME} bashNotice
CONTAINER_NAMEspecifies the name of the container.Edit the
application-oms.propertiesfile in the/home/ds/ghana/config/directory.Change
oms.iam.auth=LOCALtooms.iam.auth=SAML2.Run the following command in the container to restart the management service.
supervisorctl restart oms_console