IdP Authentication and Okta SSO [OnBase v18 SP1]

[George_Sialmas]

Hello everyone and happy Easter!

Just wanted to ask the wider community for those organisations who have successfully configured IdP to integrate with 3rd party authentication provider Okta and whether they have been able to have the various OnBase clients auto-login.

We have recently configured IdP authentication for a customer. When I RDP to any of their Windows Server 2016 Standard servers using the domain account they have provided me, I can successfully auto-login (via Okta authentication) to both the Unity Client v18.0.1.51 and the OnBase Web Client.

When the customer's OnBase admin user tries to login to the Unity Client from their Win10 workstation, they are auto-logged-in to the point where the following window (Okta SSO) is displayed:

Note: The OnBase Admin user because of social distancing measures has been testing this at home while connected to their company's VPN.

Nothing further occurs. They can close the Okta SSO window, and the OnBase splash screen also disappears. Then, they can double-click the Unity Client shortcut, and it logs them in almost immediately. This seems to suggest that Okta has responded with a successful authentication response on the first login attempt (the Trace Viewer tab of the Diag Console shows that authentication is successful) and the Unity Client is caching the response but something is preventing it from forwarding the response to the OnBase Application Server, and then on the second double-click of the Unity Client shortcut, the Unity Client is grabbing the cached response and sending it to the OnBase App Server which authorizes the user and they are logged-in.

For anyone who has successfully configured IdP and Okta integration, have you come across the above behaviour? Or does anyone have any idea as to why this behaviour is exhibited and recommend any potential troubleshooting tips or resolution?

Hoping there's someone out there that can assist with this issue.

Regards,

George

[Chad_Yarmock]

Hi George,

I would be curious to see their configuration both in Unity and in Okta. I would expect the Unity Client to display a login window to Okta upon startup. But you mentioned a few times "auto-login", which has me thrown for a loop.

Just to be sure, they are doing SP-Initiated SAML correct?

I would have them reach out to their first line of support for initial triage, and if needed work with R&D.

Thanks,

Chad Yarmock
Developer
Identity and Access Management

[George_Sialmas]

Hi Chad, the Service Location in the unity client configuration is as per below:

<add DefaultDomain="" UseADFS="false" UseInstitution="false" IdpUrl="https://uat-onbase.reecenet.org/IdentityProvider/UAT/Okta" IdpSilent="false" ServicePath="https://uat-onbase.reecenet.org/AppServer18sp1/service.asmx" DataSource="OnBase18sp1" FriendlyName="UAT (IdP Okta auth)" UseNTAuthentication="false"/>

I'm not sure what Okta configuration I can provide as I don't have access to that. Can you be more specific?

I'm not sure what you mean by SP-Initiated SAML? If it helps, what I can tell you, based on the identity provider's web.config file, there is the following line:

<provider typeKey="builtin:saml2" name="Okta" method="Saml">

I need someone to answer the following:

When a user launches Unity Client, should it prompt them with the Okta SSO window and be asked to enter their credentials? Or should it auto-log them into Unity client? 

Regards,

George