Okta configuration guide to enable SSO/SAML in FlexNet Manager Suite

Configuring SAML application in Okta

Step 1 - Create the SAML application

• Go to Okta Admin and navigate to Applications page.
• Click on "Add Application" button and then click on "Create New App".
• Choose "Web" as the platform and "SAML 2.0" as the sign-on method.
• Fill in any application name, e.g. "FlexNet Manager Suite", and click on the "Next" button.

Step 2 - Fill in the SAML settings

• Single sign on URL: https://flexnet.myorganization.com/Suite/AuthServices/Acs
• Recipient URL: https://flexnet.myorganization.com/Suite/AuthServices/Acs
• Destination URL: https://flexnet.myorganization.com/Suite/AuthServices/Acs 
• Audience restriction: https://flexnet.myorganization.com/Suite
• NameID format: Unspecified / EmailAddress
• Application username: Email

Important: All of the above URLs are case-sensitive, and ensure there is no trailing slash or space characters in the URL.

Optional Step 3 - Configure attribute statements

This is an optional step. You can configure the following attributes to pass "claims" that can be understood by FlexNet Manager Suite and will be used to pre-fill operator details.

• First name
  Type: GivenName or http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname
  
  
• Last name
  Type: Surname or http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname
  
  
• Email:
  Type: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress
  
  
• Job title
  Type: JobTitle

Step 4 - Provide the necessary details to your FlexNet Manager Suite administrator

• Once the application is created successfully in your IdP, go to the 'Sign on' tab in the SAML Application, and click on 'View Setup Instructions'.
• You will need to provide the following information to your FlexNet Manager Suite administrator:
  
  
  • Identity Provider Single Sign-On URL
    e.g. https://xxx.oktapreview.com/app/xxx_flexnetmanagersuite_1/xxx/sso/saml
    
    
  • Identity Provider Issuer (Entity ID)
    e.g. http://www.okta.com/xxx
    
    
  • Download the X.509 Certificate (IdP public certificate)
    e.g. okta.cert file containing:
    -----BEGIN CERTIFICATE----- xxxxxx -----END CERTIFICATE-----
    
    
  • Metadata file
    Copy the the metadata file contents and save it as metadata.xml.

To complete your SSO setup in FlexNet Manager Suite, refer to Ultimate SSO/SAML configuration guide in FlexNet Manager Suite.

Advanced: Automatically granting Administrator role to your newly created operators.

This is helpful when used together with createUnknownOperator="true" setting that you can set in FlexNet Manager Suite web.config file. This can be achieved by passing either one of the attribute values below:

• Role attribute
  Type: http://schemas.microsoft.com/ws/2008/06/identity/claims/role
  Expected value: Administrator
  
  
• FnmsAdmin attribute
  Type: FnmsAdmin
  Expected value: 'true' or 'false', or use custom evaluation such as: isMemberOfGroupName("Administrator")

Advanced: Enabling Single Logout in Okta

Prerequisites:

• You are using FlexNet Manager Suite On-premises.
• You have completed the Single Logout configuration in FlexNet Manager Suite and have acquired the public certificate corresponding to the private key FlexNet Manager Suite uses to sign outgoing SAML requests.

To enable Single Logout (SLO) in Okta:

• Go to Okta Admin and navigate to Applications page.
• Click on "FlexNet Manager Suite" application.
• On the General tab > SAML Setting section, click on "Edit" link.
• Go to next step and click on "show advanced settings".
• Check Enable Single Logout/Allow application to initiate Single Logout checkbox.
• Specify the following details:
  • Single Logout URL: https://flexnet.myorganization.com/Suite/AuthServices/Logout
  • Signature Certificate: browse and upload the public certificate of your Service Provider (FlexNet Manager Suite) signing key.
  • SP Issuer: issuer of the Service Provider certificate you uploaded, used by Okta for validation.
• Click on "Next" button and save your changes.