Setting up Okta SSO and SCIM v2

Setting up Okta SSO

Guru maintains an application in the Okta integration catalog that simplifies SAML based SSO through Okta.

Supported Features:

• IdP-initiated SSO
• SP-initiated SSO
• Just-In-Time provisioning
• For more information on the listed features, visit the Okta Glossary.

SP-initiated SSO

The sign-in process can be initiate from either Okta or Guru. From Guru, the steps to sign-in are...

1. From your browser, navigate to the Guru sign-in page.

   

2. Click on the Log in with SSO button and enter your email address

   

3. Guru will initiate the SSO process and redirect you to Okta to enter your credentials

SAML Configuration

• Ensure that you entered the correct value in the "Team ID" field under the General tab. The wrong Team ID value prevents you from authenticating through SAML to Guru.

• The following SAML attributes are supported:

  Name	Value
  firstName	user.firstName
  lastName	user.lastName

Installation Instructions:

1. Log into your Okta Admin portal. In the left menu, click Applications > Applications.

2. Select Browse App Catalog.

   

3. Search for "Guru", click on the Guru app, then click +Add Integration .

   

4. On the General Settings- Required page, the Application Label should read "Guru". Select your Application Visibility Settings and fill in your Team ID which can be viewed on your SSO/SCIM Team Settings page and click Done.

   

5. Click on the Sign On tab, and click on More details at the bottom of the SAML 2.0 section.

   

6. Copy fields from the details section to your Guru SSO settings page

   Okta Settings Screen

   

   Guru Settings Screen

   

   1. Copy the Sign on URL from the Okta Settings to the Identity Provider Single Sign-on Url fieldin the the Guru Settings
   2. Copy the Issuer from the Okta Settings to the Identity Provider Issuer field in the the Guru Settings
   3. Copy the Signing Certificate from the Okta Settings to the X.509 Certificate field in the the Guru Settings
   4. Set the Provision Type and Session Timeout in the Guru Settings to your desired values
   5. Toggle the SSO State to Enabled
   6. Click Update SSO button to enable SSO

7. After completing the steps in Guru, navigate back to Okta. Click on Edit in the Sign On Settings

   

8. Scroll down and set the Application username format to Email and click Save

   

9. After completing the steps in Guru, navigate back to Okta. Close the setup instructions and click on the Assignments tabs and assign People and/or Groups to the Guru application in Okta.

   

10. Finally, ask users to return to their Okta Dashboard and click on the Guru icon to log into Guru. 

---

Setting up Okta SCIM

Supported features

• Create users
• Update user attributes
• Deactivate users
• Import users
• Import groups
• Group push
• Import Schema

For more information on the listed features, visit the Okta Glossary.

Setup

1. Open the SSO/SCIM tab in Team Settings​ and toggle ​"Authorize SCIM Provisioning" to on.
2. Inside of the Guru Okta App, navigate to the Provisioning tab and click on the Configure Integration button.

3. Click the checkbox to enable the API Integration. Find your SCIM Username and Token under the SCIM Provisioning tab at the bottom of the SSO/SCIM page in Guru. Set the API Token as the SCIM Username and SCIM Token separated by a colon (for instance, if your Username is xxx and your password is yyy, your API Token would be xxx:yyy).

You can click on Test API Credentials to ensure that the credentials are accurate. Click Save.

4. Click Edit next to the Provisioning to App settings. From here, you should enable the Create Users, Update User Attributes, and Deactivate Users settings. Under Create Users, ensure that the default username is set to Email. If it is not set to email, you must navigate to the Sign On tab and change it there. Uncheck the box next to Set password when creating new users.

---

5. Navigate to the Assignments tab and assign the people or groups you'd like to add to Guru.

---

---

6. Navigate to the Push Groups tab in Okta. This is where you will add groups from Okta into Guru.

---

---

Frequently Asked Questions about authenticating to Guru through Okta

How will users log in to Guru when SSO is turned on?
After Okta SSO has been enabled in Guru, all users must log in to Guru via their Okta Dashboard. Admins will still be able to log into Guru using the web app (with their Guru username and password) as a failsafe, in case of any issues.

Will I have to still invite people to my Guru team?
If you've given your existing team members access to Guru through Okta, they will be able to sign into Guru through Okta. With new team members, it depends on the Provision Type setting in the SSO/SCIM page in Guru. With "Automatically Add Users" enabled, once a user signs in via Okta, a Guru account will be automatically created for them and they will be able to see your team's content.

How do group provisioning and Collection access work?
You can set up users who log into Guru through Okta to join one default Group in Guru. Please note that all new and current users are automatically included in the All Members group. From there, an Admin (or relevant custom role) can add the user to other Groups for them to have the appropriate Collection access.