Add Okta as an IdP and enable Custom Authentication

Add Okta as an IdP and enable Custom Authentication

Custom Authentication with Okta enables SAML-based single sign-on (SSO) from Okta to Zoho Directory. Once configured, users in your organization can access Zoho Directory from Okta without signing in to Zoho Directory.

This article outlines the steps to configure custom authentication in Zoho Directory using Okta as the Identity Provider (IdP).

Prerequisites

In Zoho Directory - Roles that can perform this action:
  1. Organization Owner
  2. Organization Admin
  3. Security Admin role
In Okta - Roles that can perform this action:
  1. Standard admin roles

In Okta: Configure SAML

  1. Sign in to Okta, then click Applications in the left Admin Console.
  2. Click Applications in the drop-down menu, then click Create App Integration. 
  3. Select SAML 2.0, then click Next. 
  4. Provide a name for the app and click Next.
  5. Fill out the fields as given below:
    1. Single sign-on URL: Enter the ACS URL from Zoho Directory.
      2. NotesYou can find the ACS URL in the Zoho Directory's Identity Providers page.
    2. Audience URI: Enter "zoho.com".
    3. Name ID format: Select the preferred format.
  6. Click Next.
  7. Follow the on-screen instructions and fill out the feedback form. This is an optional step.
  8. Click Finish. The app details page opens once the app is created.
  9. Click More details under SAML 2.0, then copy the Sign on URL and download the Signing Certificate. You'll need to submit this URL and the downloaded certificate to add Okta as an IdP in Zoho Directory.

In Zoho Directory: Add Okta as an IdP

  1. Sign in to Zoho Directory, then click Admin Panel.
  2. Click Security on the left menu.   
  3. Select Routing Policies, then go to the Identity Providers tab.
  4. Click Add Identity Provider.
  5. Choose SAML as the SSO Protocol, then enter the name of your IdP in the IdP name field.
  6. Under Sign-in URL, paste the Sign-on URL copied from Okta.
  7. Upload the Signing Certificate downloaded from Okta under X509 certificate field.
  8. Click Add. Okta will be added as an Identity Provider in Zoho Directory.

In Zoho Directory: Add Routing Policy to enable Custom Authentication

  1. On the same page, go to Routing Policies tab and click Add Policy.
  2. Enter a name for the policy, then select the members you want to apply the policy to.
  3. Select if any groups whose users should be excluded from the policy, even if they are part of the selected groups.
  4. Select the priority of this policy with other routing policies.
  5. Click Next.
  6. Under Authentication Modes, enable the Identity providers toggle, then select the IdP you added from the list.
  7. Click Next.
  8. Set Session Settings if required, then click Add. A routing policy will be created and the members of this policy will use this IdP to sign in.