Okta Configuration
Hands-on: Try the Enable Single Sign On (SSO) in Terraform Enterprise tutorial.
Follow these steps to configure Okta as the identity provider (IdP) for Terraform Enterprise.
Configure a New Okta SAML Application
In Okta's web interface, go to the Applications tab and click Create App Integration.
Select SAML 2.0 as the sign on method, and then click Next.
In the General Settings page, enter
Terraform Enterprise
, optionally add an app logo, then click Next.In the SAML Settings section, configure the following settings with the specified values:
Okta Field Terraform Enterprise SAML Field Value Single sign on URL ACS Consumer (Recipient) URL https://<TFE HOSTNAME>/users/saml/auth
Use the SSO URL for Recipient URL and Destination URL (checkbox) enabled
Audience URI (SP Entity ID) Metadata (Audience) URL https://<TFE HOSTNAME>/users/saml/metadata
Name ID format (drop-down) EmailAddress Application username Email Note: The identity provider software uses the SSO URL during authentication. It is different from the Login URL that users visit to sign in to Terraform Enterprise.
The full name for the Name ID format in the SAML specification is
urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress
.You can also choose
Email Prefix
for the application username.In the SAML Settings section, optionally configure a site admin permissions attribute statement. This statement determines which users can administer the entire Terraform Enterprise instance. Refer to Administering Terraform Enterprise for more information about site admin permissions. Under the Attribute Statements (Optional) header, configure a statement as follows:
Field Value Description Name SiteAdmin
This is the default name for TFE's site admin attribute. You can change the name of this attribute in TFE's SAML settings if necessary. Name Format (drop-down) Basic Value An Okta expression that will evaluate to a boolean: true
for every user who should have site admin permissions, butfalse
for any users who should not have site admin permissions. The exact expression depends on the user properties you use to manage admin permissions.Configure a group attribute statement to report which teams a user belongs to. Under the Group Attribute Statements (Optional) header, configure the statement as follows:
Field Value Description Name MemberOf
This is the default name for TFE's group attribute. You can change the name of this attribute in TFE's SAML settings if necessary. Name Format (drop-down) Basic Filter A filter type and filter value that will match all of the relevant groups that each user belongs to. The exact filter expression depends on how your Okta groups are configured, and which subset of groups you want to expose to TFE. Note that TFE ignores group names that do not correspond to existing TFE teams. Refer to Team Membership Mapping for more details. Click Preview the SAML Assertion and make sure it matches your expectations. Click Next.
Select I'm an Okta customer adding an internal app, and then click Finish.
Finish configuring the SAML app in Okta, and then copy the provided endpoint URLs and certificate to your Terraform Enterprise SAML settings at
https://<TFE_HOSTNAME>/app/admin/saml
(example below). TFE requires a single sign-on URL, a single log-out URL, and a PEM (base64) encoded X.509 certificate.
Example SAMLResponse