In this blog, I am listing the steps to configure SSO in Liferay with OKTA using SAML 2.0 protocol.

OKTA is an enterprise grade identity management service, built from the ground up in the cloud. Okta identity management service provides directory services, SSO, strong authentication, provisioning, workflow and built in reporting.

If you are not familiar with SAML, check out awesome blog by Mika Koivisto.

I used Liferay 6.1 EE GA2 bundled with Tomcat in this exercise.

I followed these steps: 

1. Create account at http://www.okta.com/ for enterprise trial.
2. You will get a confirmation with URL at your email address. You will able to see this screen once you access URL mentioned in mail.

​

3. Go to Applications tab and add a new application using SAML 2.0

 

4. Provide app name: 

 

5. Define SSO Url, SP entity ID, name ID format and default username at next screen. 

 

6. Make app as internal and finish, once done navigate to SSO tab. 

7. Click view setup instructions: 

Save content of  IDP metdata into octametadata.xml file.

Now we are done with OKTA (IDP) configuration setup.

Configuration at Liferay (SP) Side:

1. Extract Liferay bundle into some location.
2. Start the server and deploy SAML plugin downloaded through marketplace.
3. Paste octametdata.xml file into data folder of Liferay.

 4.  Create the keystore using java key tool along with the public and private keys.

              keytool -genkeypair -alias samlspdemo -keyalg RSA -keysize 2048 -keypass password -keystore data/keystoresp.jks

 5. Once done create portal-ext.properties in Liferay Home and add these lines into this file:  

saml.role=sp

saml.entity.id=samlspdemo 

saml.metadata.paths={location of saved octametdata.xml}

# # Keystore #

saml.keystore.type=jks

saml.keystore.path=${liferay.home}/data/keystoresp.jks

saml.keystore.password=password

saml.keystore.credential.password[samlspdemo]=password

 

# # Service Provider #

saml.sp.default.idp.entity.id=http://www.okta.com/kpqs6np8EEBKPQZCLHXQ

saml.sp.sign.authn.request=true

saml.sp.assertion.signature.required=false

saml.sp.clock.skew=3000

saml.sp.session.keepalive.url=http://localhost:8080/c/portal/saml/idp/keepalive

 6. Restart Liferay to check the functionality.

After this once you click login in Liferay portal, it will redirect you okta sign in page, enter credentials there and if you entered correct credentials it will redirect you to Liferay where you will be automatically login.

Note :

1. Make sure you create same user in Liferay and OKTA for basic setup.
2. Assign user to the app you created in OKTA.