Configure SAML authentication

The following is an overview of how to configure Okta as your IdP:

1. Create an Okta app.
2. Configure the Okta app.
3. Gather information about the Okta app.
4. Configure Okta as an IdP in Calabrio ONE.

Create an app in Okta

1. Log in to Okta.

   NOTE   You must be a Super Administrator in Okta to create and configure an app.

2. Navigate to Applications > Applications.
3. Click Add Application.
4. Click Create New App.

5. In the Create New Application Integration dialog box, configure the fields as follows.

   Field	Configuration
   Platform	Select Web.
   Sign on method	Select SAML 2.0.

Configure the Okta app

1. In the General Settings tab, configure the fields as follows.

   Field	Configuration
   App name	Enter a unique name for Calabrio ONE.
   App logo	(Optional) Upload an image to identify Calabrio ONE in Okta.
   App visibility	(Optional) Limit who can see the image in Okta.

2. Click Next.

3. On the Configure SAML tab, configure the fields as follows.

   NOTE   If Advanced Settings is hidden, click Show Advanced Settings.

   Field	Configuration
   General
   Single sign on URL	Copy and paste this URL from the Authentication page in Calabrio ONE. The URL is located in the Single Sign On URL field in the Service Provider section. Leave the Use this for Recipient URL and Destination URL check box selected (default).
   Audience URI (SP Entity ID)	Copy and paste this ID from the Authentication page in Calabrio ONE. The URL is located in the Entity ID field in the Service Provider section.
   Name ID format	Select EmailAddress.
   Application username	Select Email.
   Response	Select Signed.
   Assertion Signature	Select Signed.
   Signature Algorithm	Select either RSA-SHA1 or RSA-SHA256.
   Digest Algorithm	Select either RSA-SHA1 or RSA-SHA256.
   Assertion Encryption	Select Unencrypted.
   Enable Single Logout	Leave the Allow application to initiate Single Logout check box cleared (default).
   Authentication context class	Select PasswordProtectedTransport.
   Honor Force Authentication	Select Yes.
   SAML Issuer ID	Leave blank.
   Attribute Statements
   Name	Enter a unique name.
   Name format	Select Unspecified.
   Value	Select user.email.

   NOTE   You do not need to configure any attributes in the Group Attribute Statements section.

4. Click Next.

5. In the Feedback tab, select the Feedback option that is appropriate to your company’s use of Okta.

   NOTE   Your choice does not affect the ability of Calabrio ONE to use Okta as an IdP.

6. Click Finish.

Gather information for Calabrio ONE from the Okta app

1. Navigate to Applications > Applications, and then click the Okta app for Calabrio ONE.
2. Select the Sign On tab.
3. Click View Setup Instructions.

4. Gather information about the Okta app from the following fields:

   Field	Instructions
   Identity Provider Single Sign-On URL	Copy the URL and store it in an easy-to-access location.
   Identity Provider Issuer	Copy the URL and store it in an easy-to-access location.
   X.509 Certificate	Download the certificate and store it in an easy-to-access location.

5. Refer to Configuring an Authentication Method to configure an Okta identity provider with Calabrio ONE and enable SAML authentication.

The following is an overview of how to configure single sign-on for Active Directory Federation Services (AD FS):

1. Configure Relying Party Trust for your identity provider.
2. Configure the LDAP email claim rule for the Calabrio ONE trust.
3. Configure the incoming claim transform rule for the Calabrio ONE trust.
4. Configure the secure hash algorithm and import your service provider certificate.
5. Export your identity provider certificate.
6. Configure an ADFS identity provider with Calabrio ONE and enable SAML authentication.

Configure Relying Party Trust for your identity provider

Configuring Relying Party Trust for your identity provider is a multistep procedure.

First, begin the Add Relying Party Trust Wizard.

1. Open the Windows Server AD FS Management Console.
2. Expand the Trust Relationships folder.
3. Right-click the Relying Party Trusts folder, and then click Add Relying Party Trust to begin the Add Relying Party Trust Wizard.
4. Click Start.

Next, configure Relying Party Trust with the Add Relying Party Trust Wizard.

1. Choose Enter data about the relying party manually, and then click Next.
2. Enter “Calabrio ONE” in the Display name field, and then click Next.
3. Choose AD FS profile, and then click Next.
4. Click Next on the Configure Certificate step. You do not need to specify an optional token encryption certificate.
5. Select the Enable support for the SAML 2.0 WebSSO protocol check box, enter the Single Sign On URL (found under Service Provider on the Authentication page), and then click Next.
6. Enter the Entity ID (found under Service Provider on the Authentication page) in the Relying party trust identifier field, click Add, and then click Next.
7. Choose Permit all users to access this relying party, and then click Next.
8. Click Next on the Ready to Add Trust step to complete configuration and add the relying party trust.
9. Select the Open the Edit Claim Rules dialog for this relying party trust when the wizard closes check box, and then click Close. The Edit Claim Rules window opens automatically.

Configure the LDAP email claim rule for the Calabrio ONE trust

1. Click Add Rule... under the Issuance Transform Rules tab in the Edit Claim Rules window.
2. Select Send LDAP Attributes as Claims from the Claim rule template drop-down list, and then click Next.
3. Enter “LDAP Email Address” in the Claim rule name field.
4. Select Active Directory from the Attribute store drop-down list.
5. Select E-Mail Addresses from the LDAP Attribute drop-down list.
6. Select E-Mail Address from the Outgoing Claim Type drop-down list.
7. Click Finish to complete configuration of this claim rule and add the incoming claim transform rule.

Configure the incoming claim transform rule for the Calabrio ONE trust

1. Click Add Rule... under the Issuance Transform Rules tab in the Edit Claim Rules window.
2. Select Transform an Incoming Claim from the Claim rule template drop-down list, and then click Next.
3. Enter “Transform Email Address” in the Claim rule name field.
4. Select E-Mail Address from the Incoming claim type drop-down list.
5. Select Name ID from the Outgoing claim type drop-down list.
6. Select Transient Identifier from the Outgoing name ID format drop-down list.
7. Choose Pass through all claim values.
8. Click Finish to complete configuration of this claim rule.
9. Click OK to finish editing claim rules and close the Edit Claim Rules window.

Configure the secure hash algorithm and import your service provider certificate

1. Open the Windows Server AD FS Management Console.
2. Double-click the Calabrio ONE trust you created in the above step to open the Calabrio ONE Properties window.
3. Click the Advanced tab, and then select SHA-1 from the Secure hash algorithm drop-down list.

4. Click the Signature tab, and then click Add... and select your service provider certificate.

   NOTE   If you don’t see your service provider certificate, you might need to select All files (*.*) in the file-type filter in the lower left corner of the window.

5. Click OK to finish editing the trust properties and close the Calabrio ONE Properties window.

Export your identity provider certificate

1. Open the Windows Server AD FS Management Console.
2. Expand the Certificates folder.
3. Double-click the Token-signing certificate to open the Certificate window.
4. Click the Details tab, and then click Copy to File... to begin the Certificate Export Wizard.
5. Click Next to continue.
6. Choose Base-64 encoded X.509 (.CER), and then click Next.
7. Specify a unique file name and location to save the file, and then click Finish. A dialog box reporting that the export was successful should appear. Use the contents of the exported file to configure your IdP with Calabrio ONE.
8. Refer to Configuring an Authentication Method to configure an ADFS identity provider with Calabrio ONE and enable SAML authentication.

Field	Description
Authentication URL	(Read-only) The URL for Calabrio ONE that directs you to the single sign-on URL.
Entity ID	(Read-only) The entity ID provided by Calabrio ONE. Use this information to configure your IdP.
Use Tenant Name in Entity ID	Select this check box to prepend the name of the tenant to the tenant’s public host name in the Entity ID.
Single Sign On URL	(Read-only) The URL to send SAML responses to from the IdP. Use this information to configure the Assertion Consumer Service URL on your IdP. This URL supplied by Calabrio ONE is not the same as the Single Sign On URL provided by your IdP, which must be entered in the field under Enable SAML Authentication.
SAML Signature Algorithm	The Default algorithm is configured by your organization. Other supported algorithms are SHA1, SHA256, and SHA512.
SAML Digest Algorithm	The Default algorithm is configured by your organization. Other supported algorithms are SHA1, SHA256, and SHA512.
Sign SAML Response	This box is selected by default. Clear this if you do not want to sign the SAML response.
Service Provider Certificate	(Read only) The certificate to configure your IdP with Calabrio ONE. You can use the default global certificate provided by Calabrio ONE (cloud deployments only) or upload a self-managed certificate and private key. See Managing service provider certificates for Calabrio ONE. Import—Imports a self-managed service provider certificate into Calabrio ONE. Export—Exports your current service provider certificate. View Details—Shows the details of the current service provider certificate: issuer, subject, and start and end date. Export Metadata—Exports the metadata for the current service provider certificate.
Private Key	The private key for a self-managed service provider certificate. See Managing service provider certificates for Calabrio ONE. Import—Imports a new private key for a self-managed service provider certificate. The syntax of this private key must be PKCS 8. Delete—Deletes the existing private key.