Integrate Sumo Logic with Okta

Before you start

• Read the "Limitations section" on Set Up SAML for Single Sign-On.
• If you plan to manage Sumo role assignments on Okta, before you proceed, make sure that you have: 
  • Configured an Okta group for each Sumo role, with the same name as the Sumo role. For example, you should have an “Administrator” group in Okta, just as you have an “Administrator” role in Sumo.
  • Assigned your Sumo users to the appropriate Okta groups, based on the Sumo roles you want to assign to each user.  

Step 1: Configure basic SAML settings in Okta

1. Log in to your Okta organization as a user with administrative privileges.
2. Click Admin.
   
3. Click Add Applications.
   
4. Click the Create New App shortcut.
   
5. On the Create a New Application Integration page, select the SAML 2.0 option, then click Create.
   
6. General Settings.
   • App Name. Enter a name for the Sumo Logic integration app.
   • App Logo. (Optional) Upload the logo you want to appear for the app in the Okta portal.
   • Visibility. Use these options if you don’t want the Sumo Logic integration app to appear to users in the Okta portal or mobile app.
   • Click Next.
     
7. In the General section under SAML Settings:
   1. Single sign on URL. Paste in this placeholder URL:
      http://example.com/saml/sso/example-okta-com
      You will get the actual URL to enter when you perform Step 5: Configure SAML in Sumo, and enter them when you perform Step 6: Complete SAML configuration in Okta.
   2. Use this for Recipient URL and Destination URL. Click the checkbox.
      
8. Audience URI (SP Entity ID). Enter the domain name of the Sumo Logic deployment that your Sumo account resides in. For example:
   https://service.us2.sumologic.com
9. In the Attribute Statements section under SAML Settings add three attribute statements:
   1. For Name, enter ”firstName” and select user.firstName from the Value pulldown.
   2. For Name, enter ”lastName” and select user.lastName from the Value pulldown.
   3. For Name, enter ”Email” and select user.email from the Value pulldown.
      

Step 2: Configure Okta to send role assignments to Sumo (Optional)

In this step, you configure Okta to send group membership information in the SAML assertions it sends, so that Sumo can assign roles to a user at each logon. This allows you to manage Sumo role assignments in Okta. If you don’t want manage Sumo roles in Okta, click Next at the bottom of the Create SAML Integration page and proceed to Step 3 below.

These instructions assume that:

• You have configured a set of groups on Okta whose names match the names of the roles defined in Sumo.
• You have assigned each user in Okta to the Okta groups that maps to the roles you want the user to have.

There are two sides to the configuration. You'll configure a Group Attribute Statement in Okta and a Roles Attribute in Sumo Logic, eachh with the same value. Okta will include that attribute value in the SAML assertions it sends to Sumo. 

1. Name. Enter something like “Sumo_Role” and make a note of it. Later, when you configure SAML in Sumo Logic, you’ll enter the same value in the Roles Attribute field. 
2. Name Format. Leave unspecified.
3. Filter. In the left-side field, choose one of the options from the pulldown, to select the type of match expression you are going to enter:
   1. Starts with. Useful of all the names of the Okta groups with Sumo users all begin with the same string.
   2. Equals. Useful if there is a single Okta group for Sumo users.
   3. Contains. Useful if all the names of the Okta groups with Sumo users all contain the same string.
   4. Matches regex. Use this option if you can’t specify your groups using any of the other filter types.  
4. In the right-side field, enter a string or regular expression, depending on the filter type you chose. In the screenshot above, the filter type is Matches regex, and the regex Foo|A.* will match the Okta group “Foo” and groups whose names begin with the letter “A”.
5. Click Next at the bottom of the Create SAML Integration page to proceed.

Step 3: Enter Okta feedback info

In Step 3 "Feedback", select I'm an Okta customer adding an internal app, and This is an internal app that we have created, then click Finish.

Step 4: View Okta SAML settings for Sumo

In this step, you view the SAML settings generated by Okta that you’ll need when complete the SAML configuration in Sumo.

1. On Sign On Methods section appears. Click View Setup Instructions.
2. The page displays the information you need to do Step 5: Configure SAML in Sumo. Keep the page open.
   

Step 5: Configure SAML in Sumo

This section has instructions for configuring basic SAML in Sumo Logic.

1. Go to Administration > Security > SAML.
2. Click Add Configuration.
                                                                                               
3. The Add Configuration page appears.
   
4. Configuration Name. Enter a name to identify the SSO policy (or another name used internally to describe the policy).
5. Debug Mode. Select this option if you'd like to view additional details if an error occurs when a user attempts to authenticate. For more information, see View SAML Debug Information.
6. Issuer. Paste in the Identity Provider Issuer that Okta presented in Step 4: View Okta SAML settings for Sumo.
7. X.509 Certificate. Paste in the certificate that Okta presented in  that was presented in the Step 4: View Okta SAML settings for Sumo.
8. Attribute mapping. Select Use SAML Subject.
9. Roles Attribute. (Required if you performed the steps in Step 2: Configure Okta to send role assignments in Sumo). If you specify the Roles Attribute option, Sumo Logic assigns roles to a user every time the user logs in. Roles are configured by your Okta  administrator and assigned as part of the SAML assertion.
   1. Click the Roles Attribute checkbox. The Roles Attribute field appears.
   2. Roles Attribute. Enter the Group attribute name, for example "Sumo_Role", you defined in Step 2: Configure Okta to send role assignments in Sumo.
10. On-demand provisioning. If you configure this feature, Sumo Logic will create a new user’s account the first time the user accesses Sumo Logic using Okta. For instructions, see On-Demand Provisioning.
11. Logout Page. When a Sumo user logs out of Sumo Logic or if the user’s session times out, they will be redirected to the logout page you specify. For example, you could redirect users to their Okta homepage, substituting your Okta domain in the following URL:
    https://YourOktaDomain.onelogin.com/app/UserHome
12. Click Save. 
13. To view the details of your configuration, select it the Configuration List. Keep the panel open. When you complete the Okta configuration in Step 3 below, you will copy the Authentication Request and Assertion Consumer values into Okta.

Step 6: Complete SAML configuration in Okta

1. Go back to the Okta Admin Panel.
2. Go to the General tab.
3. Under SAML Settings, click Edit. 
   
4. The General Settings page appears. Click Next. 
5. The Edit SAML Integration pane appears.
   
6. Single Sign On URL. Change to the Assertion Consumer URL from your Sumo Logic SAML settings, which you obtained in the last step of Step 5: Configure SAML in Sumo.
7. Use this for Recipient URL and Destination URL.  Deselect the checkbox.
8. Recipient URL and Destination URL. Enter the Authentication Request URL from your Sumo Logic SAML settings, which you obtained in  the last step of Step 5: Configure SAML in Sumo into both fields.
9. Audience URI (SP Entity ID). This field is not required unless you configure SP-initiated authentication. For more information see SP-initiated login.
10. Click Next and then Finish.

Sumo Logic is now linked with Okta. 

Step 7: Add Okta users to the Sumo Logic app in Okta 

1. Click the Directory tab. Click the user you want to add to the app.
   
2. Click Assign Applications.
   
3. Click Assign on the row for the application to which you want to add the user.
   
4. Click Save and Go Back.
   
5. Click Done.

The Sumo Logic app you configured should now appear on the user’s Okta work page. To check that the integration works, have the user click the app icon, and verify that they are logged onto Sumo Logic. 
 

Configure optional SAML features

_index=sumologic_audit action=login | count by class, sourceuser 

_index=sumologic_audit action=login | count by class, sourceuser