OKTA SSO Configuration

The following guide steps through configuring your Razor tenant with the required details to enable OKTA Single Sign-On.

Supported Features
Authentication Only
Provide access to your full Razor Tenancy using OKTA’s single sign-on authentication platform.

Service Provider (SP) Initiated Login Only
Begin your SSO journey from the Razor Portal.

The following are not supported by this integration:

• IdP-initiated SSO (launching Razor from the Okta End-User Dashboard / app chiclet)
• Just-In-Time (JIT) provisioning — users must exist in Razor before their first SSO sign-in
• SCIM provisioning
• Single Logout (SLO)

For more information on the listed features, visit the Okta Glossary.

Prerequisites

Complete the following before you begin. Skipping any of these is the most common cause of a failed first sign-in.

In Razor

• An active Razor tenant. SSO is configured per tenant, on top of the standard username/password access provisioned during on-boarding.
• A Razor administrator account with permission to view and edit Company Settings. This account must also exist in Okta and be assigned to the Occam Razor app integration, since it will need to sign in via Okta once SSO is enabled.
• All users who will sign in via Okta have already been created in Razor, under User Settings. The email address on the Razor user record must match the primary email address on the corresponding Okta user profile, exactly. Razor does not create accounts on the fly — an Okta user with no matching Razor account will fail to sign in.
• The URL you use to reach Razor (see Verify SSO for the regional URLs). You need this to know which Razor instance to configure and test against.

In Okta

• An Okta org running Okta Identity Engine.
• Okta administrator rights sufficient to add an app integration from the Okta Integration Network catalog and to read its client credentials — a Super Administrator, or an Application Administrator combined with the ability to assign users and groups.
• The users and/or groups you intend to assign to the Occam Razor app integration, identified in advance.

Before you start

• A secure place to record the Client ID, Client Secret and Okta domain. The client secret is displayed by Okta at creation time and should be treated as a credential.
• A second browser or a private/incognito window, so you can test SSO without disturbing your existing authenticated Razor session.

How enabling SSO affects your users

Enabling Okta SSO does not switch your whole tenant over at once. Username and password sign-in continues to work for your tenant.

The change is per user: once a user signs in through the Okta link, that user authenticates through Okta from then on and no longer signs in with a Razor password. Users who continue to use the standard sign-in page are unaffected.

Before you direct users to the Okta sign-in link, confirm that:

• Every user who needs Razor access exists in Razor with an email address that matches their Okta profile.
• Those users are assigned to the Occam Razor app integration in Okta.
• You have verified the Client ID, Client Secret and Okta domain values before saving.

Because password sign-in remains available at the tenant level, you can pilot SSO with a small group before rolling it out more widely.

1. ON-BOARDING

As part of your Razor on-boarding your tenant will be configured for traditional user/password access. For your company’s users to initiate OKTA Single Sign-On (SSO) they are required to have been previously added under the user settings in Razor. Attempting to log directly in via OKTA without prior configuration will result in a failure to log in.

2. ADD OCCAM RAZOR INTEGRATION TO OKTA INSTANCE

After logging in to your OKTA tenancy, navigate to the Applications page via the side navigation bar and select “Browse App Catalog”.

On the Catalog page use the search bar to find “Occam Razor”, selecting the application in the search results. 

 After clicking “Add Integration” and “Done” to complete the integration. Select the “General” Tab and make a note of the Embed Link. 

The final set of credentials can be found under the “Sign On” tab, where you will have the opportunity to securely note down your Client ID and Client Secret.

These three pieces of information (Embed Link, Client ID, Client Secret) are all required to be configured on the Razor platform to enable SSO. (See next section)

3. UPDATE OKTA CONFIGURATION

After adding the Razor integration to your OKTA instance via the OIN Marketplace (https://www.okta.com/integrations). Once in possession of your OKTA credentials, navigate to the Company Settings page.

Once in the editable form for your company settings, scroll down to the Okta Integration section.

Populate the Client ID, Secret. Shorten the Embed Link from your OKTA credentials, to just the protocol and domain. (See example)

Example:
Client ID: 0ooowww1112222xxxx599

Secret: 1234569849874987

URL: https://your-org-name.okta.com

4. SIGN IN

Once your settings are saved, after logging out you can access the OKTA SSO Integration, via the sign in link.

Verify SSO

Razor supports SP-initiated SSO only. The sign-in journey always starts from the Razor portal, not from the Okta End-User Dashboard.

Use the sign-in URL for the region your tenant is hosted in:

If you are unsure which region hosts your tenant, use the URL supplied during on-boarding, or contact Occam support.

Enter the email that you are registered to Razor with, and click “Go To Okta”

Login to your Okta Instance. You will be redirected back to Razor once authentication is complete.

Troubleshoot

If the issue persists, contact Occam support at [email protected] with your tenant name, the Razor region, the affected user’s email address and the approximate time of the failed sign-in attempt.

Read about Azure SSO Config Guide and OneLogin SSO Config Guide here.