• Okta account with admin permissions.
• Admin or super-admin user role within Hudu.
• All users are provisioned in Okta with the same exact email address. We don't create new user accounts with SSO.
• Ensure that the users have already been created in Hudu before starting this process.

Guides

How to Enable SSO

• Login to Hudu and click the Admin tab on the top toolbar.
• Click General.
• Click Configure Single Sign-On.
• Enter SAML details. See the relevant section below on how to fill this information out.
• Click Enable Single Sign-On.
• Hit Update SAML Details and SAML should now be activated.

Configuring Okta

• Inside Okta, click Admin in the top right.
• • Navigate to the Applications screen and click create app integration.

• When the modal pops up, select SAML 2.0, and then click "Next".

• On the next screen, give the Application a name.

• In Configure SAML, fill in the following fields:
  
  • Single sign-on URL: Enter the URL of your Hudu instance followed by /saml/consume
    • e.g. https://docs.mywebsite.com/saml/consume
  • Audience URI: Enter the URL of your Hudu instance.
    • e.g. https://docs.mywebsite.com
  • Name ID format: Choose EmailAddress.
  • Application username: Choose Email.

• Click "Show Advanced Settings" and fill out the following fields:
  • Signature Algorithm: Choose RSA-SHA1
  • SAML Issuer ID: fill in exactly:

    https://okta.com/${org.externalKey}

• Click Next.
• Now, choose:
  1. I'm an Okta customer adding an internal app.
  2. This is an internal app that we have created.

• Then click Finish
• On the next screen, click View Setup Instructions.

• Keep the setup instructions open as you fill out the info in Hudu.

Configuring Hudu

1. In Hudu, with a user role of Admin or Super Admin:
   • Navigate to your Hudu admin area >> General >> SAML/SSO Configure.
2. Provide Identity Provider (IdP) information:
   
   • SAML Issuer URL: This is what Okta calls their "Okta Identify Provider Issuer." Copy this exactly into Hudu.
   • SAML Login Endpoint: This is what Okta calls their "Okta Identity Provider Single Sign-On URL." Copy this exactly into Hudu.
   • SAML Logout Endpoint: This will be the same as your Login URL; the "Okta Identity Provider Single Sign-On URL." Copy this exactly into Hudu.
   • SAML Fingerprint:
     • To ensure that you are obtaining the correct fingerprint (thumbprint) for your algorithm:
       • Copy the certificate.
       • Paste the certificate into a tool such as https://developers.onelogin.com/saml/online-tools/x509-certs/calculate-fingerprint
       • Choose either SHA-1 or SHA-256 as the algorithm.
         • If choosing SHA-256, you will also need to ensure that the 'Use SHA-256' option is checked (in the Hudu SAML setup area).
       • Copy either the non-formatted or formatted fingerprints provided and paste them into Hudu SAML Fingerprint.
   • SAML Certificate: This is provided by Okta, and should be the same certificate used to configure the fingerprint; copy this exactly.
     
     • -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- should be included.
     • Paste into the SAML Certificate field. Make sure there is no extra space trailing at the end!
3. • SAML ARN: This signifies the Authentication Context that Hudu will provide to the IdP. AuthnContext is the method by which a user tries to log in (i.e. via password, passwordless, etc.).
     
     • If you specify Do not pass RequestedAuthnContext in your request, the URN is used by the IdP to say "I don't want to tell you how I identified the user".
       • Requested Authentication Context may be required for your IdP, but it is typically optional.
       • If you have users that use Passwordless login to your IdP; do not pass RequestedAuthnContext must be selected.
     • If you specify Password in your request, the IDP knows it has to authenticate the user through login/password.
     • If you specify PasswordProtectedTransport in your request, the IDP knows it has to authenticate the user through login/password, protected by SSL/TLS.
4. Click Enable Single Sign-On.
5. Hit Update SAML Details and SAML should now be activated.

Testing SAML

Disable Password Access for non-Admins