Upload
others
View
12
Download
0
Embed Size (px)
Citation preview
ActiveDirectoryConfigurationGuide Ó2016Veeva.Allrightsreserved.
OrgWikiÒActiveDirectoryConfigurationGuideIntroductionThisguideprovidesinstructionsforconfiguringOktawithOrgWikitoallowauthenticationandprovisioningtobedrivingbyyourexistingActiveDirectoryinfrastructure.ThisguideisintendedforcustomerswhosignedupforOktathroughOrgWiki.ExistingcustomersofOktashouldrefertotheOktaConfigurationGuideTheActiveDirectoryintegrationinvolvesthreemainsteps:
1. ConfiguretheintegrationbetweenOktaandOrgWiki-ThisallowsOktatohandleauthenticationforOrgWikiandtoprovideautomatedprovisioning.
2. SetupActiveDirectoryintegrationwithOkta–ConfiguretheOktaActiveDirectoryAgentwithyourADinstanceandsetupprovisioningrulestoenableautomatedprovisioningofADusersintoOrgWiki
3. Setuptheattributemappings–ThesearemappingsbetweenuserattributesinADandOktaandbetweenOktaandOrgWikitoensuretheappropriateADattributesareprovisionedtoOrgWiki
ConfigureIntegrationbetweenOktaandOrgWikiSignupforOrgWikiandOktaathttps://www.theorgwiki.com/embedded_okta.Thefieldsontheregistrationformwillbeusedto:
1. SignupforanewOktaaccount(includesthefirstadminuser)2. AddtheOrgWikiapptotheOktaaccount3. AssignthefirstadminusertotheOrgWikiapp4. SignupforanewOrgWikiaccount5. ConfigureOrgWikitouseOktaforsingle-signonviaSAML
AftertheabovestepshavebeencompletedyouwillbepromptedtologinviaOktaandthenredirectedtoOrgWiki.SetupActiveDirectoryintegrationwithOktaTosetupActiveDirectory,pleasefollowtheinstructionsonInstallingandConfiguringtheActiveDirectoryAgent.Oncethisiscompleted,userandemployeedatawillbeperiodicallysyncedfromADintotheOktadirectory.Oktarecommendsyouusegroupstotriggerauto-provisioning–onceADgroupsareimportedintoOktayouwillassociateuserswithOrgWikiviatheappropriategrouptotriggerauto-provisioning.
ActiveDirectoryConfigurationGuide Ó2016Veeva.Allrightsreserved.
CustomizeAD-OktaattributemappingAkeystepofAD-drivenprovisioninginvolvessettingupattributemappingsfromADintoOktaandthenfromOktatoOrgWiki.UsetheProfileEditortoreviewtheADtoOktamappingsTosetupmappings,intheOktaAdminDashboardyouneedtogotoDirectory->ProfileEditor.SelectyourActiveDirectoryinstanceandclickonMappingstoreviewthecurrentmappings.(Note–youshouldbelookingatthe[AD]toOktamappings.)Bydefault,theOrgWikiusernameissettotheOktausernamewhichdefaultstotheUPN(fromActiveDirectory)oftheuser.OrgWikirequirestheusernamevaluetobetheemailaddressoftheuser.Pleaseensureappuser.emailismappedtotheloginfield
SetupOktaprovisioningtoOrgWikiThefollowinguserattributescanbeprovisionedfromOktatoOrgWiki:DefaultOktaDirectoryattributes:
Attribute Required/Optional CommentsFirstName Required LastName Required Email Required Title Required ManagerID
(emailaddressorIDofmanager)Optional
-Usedforcreatingtheorgchart.-IfIDisuseditneedstomatchthemanager’sExternalId
StreetAddress Optional Setonprofilesandusedforaddingemployeestolocationgroupsandoffices.City Optional
State OptionalCountry OptionalOfficePhone Optional
ActiveDirectoryConfigurationGuide Ó2016Veeva.Allrightsreserved.
MobilePhone Optional Nickname Optional
UserType Optional Ifthevalueis“contractor”theemployeewillbemarkedasacontractorinOrgWiki.
Customattributes:
Attribute Required/Optional CommentsStartDate
(mustbeformattedYYYY-MM-DD) OptionalUsedforschedulingthenewhireannouncementandshowingthetenureofanemployeeontheirprofile.
OrgWikiExternalID Optional UniqueIDforemployeese.g.anemployeeID.
StartDateandOrgWikiExternalIDarecustomattributesthatcanbemappedtoOrgWiki.SeeAppendixAandBformoredetailedonaddingtheseattributes.
• FromtheProvisioningtaboftheOrgWikiapp,checktheEnableprovisioningfeaturesbox(seebelow).
ActiveDirectoryConfigurationGuide Ó2016Veeva.Allrightsreserved.
• IntheAPIAuthenticationsection,clickAuthenticatewithOrgWiki(seebelow).o Note:ThisuserwillbeusedtoprovisionusersintoOrgWiki.
• AmessagewillappearwithoptiontoallowOktatoconnecttoyourOrgWikiinstance.ClickAuthorize(seebelow).
ActiveDirectoryConfigurationGuide Ó2016Veeva.Allrightsreserved.
• NowyourOrgWikiappisauthenticated,scrolldowntheProvisioningpageandselecttheprovisioningfeaturesyouwanttoenable(seebelow).
• ClickNext.CustomizetheattributemappingfromOktatoOrgWikiToeditthemappingsbetweenOktaandOrgWiki,clicktheEditMappingsbuttonunderAttributeMappings,andselecttheOktatoOrgWikitabtoreviewthedefaultmappings.Note–topopulatethemanager’semailaddressintotheOrgWikiManagerIDfieldyoucanusethefollowingexpression:getManagerAppUser(“active_directory”,”active_directory”).email
FormoreinformationonOkta’sexpressionlanguageseehttp://developer.okta.com/reference/okta_expression_language/
ActiveDirectoryConfigurationGuide Ó2016Veeva.Allrightsreserved.
AssigninguserstoOrgWikiYoucannowassignuserstotheOrgWikiapp.Donotassignusersmanuallyifyouhavealargenumberofusers,asthisdoesnotscalewell.Instead,useagroupyou’vesynchronizedfromADorcreateagroupdirectlyinOktaforthepurposeofapplicationassignment.ToassignOrgWikitoaselectedgroup:
• InOkta,fromtheAdminDashboard,selectDirectory>Groups,andthenselectthegroupyouwanttoassignto.
• ClicktheManageAppsbuttontoassignappstothegroup(seebelow).
ActiveDirectoryConfigurationGuide Ó2016Veeva.Allrightsreserved.
• SearchfortheOrgWikiappandclickAssign,thenclickDone(seebelow).
ActiveDirectoryConfigurationGuide Ó2016Veeva.Allrightsreserved.
AppendixA. AddingStartDateAttribute
OrgWikihasaStartDateattributetotheuserprofile.Beforeaddingtheattribute,makesurethedateisformattedcorrectly(YYYY-MM-DD)forOrgWikiusage.Forexample,“2016-01-15”.FollowthestepsbelowtoaddtheStartDateuserattributetotheuserprofile:• InOkta,fromtheAdmindashboard,selectDirectory>ProfileEditor.• SelecttheAppssectionintheleftnavigationbar,thenfindtheOrgWikiappinthelist.• ClickProfilethenclickAddAttribute.
• Type“StartDate”fortheDisplaynamefield.• Type“startDate”fortheVariablenamefield.• ForDescription,type“Employee’sstartdatewiththecompany”.• SelectStringfortheDatatypefield.• YoumayleaveAttributerequiredunchecked.• LeaveScopeunchecked.• ClickAddAttribute.
B. AddingOrgWikiExternalIDAttribute
ThisOrgWikiExternalIDattributecanbeusedtoassociateauniqueIDwithOrgWikiprofiles.FollowthestepsbelowtoaddtheOrgWikiExternalIDuserattributetotheuserprofile:
ActiveDirectoryConfigurationGuide Ó2016Veeva.Allrightsreserved.
• InOkta,fromtheAdmindashboard,selectDirectory>ProfileEditor.• SelecttheAppssectionintheleftnavigationbar,thenfindtheOrgWikiappinthelist.• ClickProfilethenclickAddAttribute.
• Type“OrgWikiExternalID”fortheDisplaynamefield.• Type“orgwikiExternalId”fortheVariablenamefield.• ForDescription,type“Auniqueidentifierforthisemployee–typicallyusedacross
apps”.• SelectStringfortheDatatypefield.• YoumayleaveAttributerequiredunchecked.• LeaveScopeunchecked.• ClickAddAttribute.