Prepare Abiquo enterprise and role

1. Log in to your Abiquo and Go to the Users tab.

2. Create a new enterprise with the desired scope,i.e. ExternalEnterprise with Global Scope:
   
   

3. Open

   

   After the new enterprise is created go to the Roles tab and create a new role inside this enterprise, give it a name, and fill in External Roles with the name the users in Okta will have as their Title, i.e.: External_role:
   
   

   Open

   

   Note: The role Name is Abiquo side only, so it does not matter that much. The external role is the value that will be checked against what comes from Okta in the abq-role attribute claim.

4. Save the new role, assign desired privileges to the role, and save the changes.

Set up Okta integration

1. Create an Application

1. Log in to Okta with Google account or email at: https://developer.okta.com/login or create a new account at: https://developer.okta.com/signup/ (Free developer edition)

2. Go to Applications→ Applications

3. Click Create App integration

4. Choose SAML 2.0 from the list and Next

5. Choose the Name, i.e Abiquo-test, Next

6. Set Single sign-on URL: https://{$ENV_FQDN}:443/api/saml/SSO
   i.e.: https://aleksandra-cleandistr-server.lab.abiquo.com:443/api/saml/SSO

7. Set Audience URI (SP Entity ID): https://{$ENV_FQDN}:443/api/saml/metadata
   i.e.: https://aleksandra-cleandistr-server.lab.abiquo.com:443/api/saml/metadata

8. In the Attribute Statements (optional) section add the following: 

and click Next

9. Select any option for feedback and click Finish

10. In Settings→ Sign on methods, SAML 2.0 section of your application open the metadata link in the new tab, and save the page as idp_metadata.xml, do not close the tab yet
    
    

11. From the metadata page, note down the entityID value, i.e.: http://www.okta.com/exkezXXXXXXXX45d7 we will use it later to configure Abiquo.

    Now you can close the tab.

Important: You cannot have a slash ‘/’ at the end!

12. Go to the SAML Signing Certificates section of your application and download the currently active certificate:
    
    

2. Create an Identity Provider

13. Go to Security→ Identity providers

14. Click ‘Add identity’ provider

15. Choose SAML 2.0 idP from the list and confirm

16. Set the Name to your idP, i.e. Abiquo

17. In the Authentication Settings set IdP username to idpuser.subjectNameId

18. In the SAML Protocol Settings section set:
    IdP Issuer URI enter https://{$ENV_FQDN}:443/api/saml/metadata
    IdP Single Sign-On URL enter https://{$ENV_FQDN}:443/api/saml/SSO
    Destination enter https://{$ENV_FQDN}):443/api/saml/SSO

19. As IdP Signature Certificate point to the certificate you downloaded from your application in step 12. and Finish

3. Assign the Application to the user

20. Go to the Directory menu-> People

21. Click on your user and in the Applications tab Assign Application

22. Click on the Assign link next to your application name and Save and Go back, Done

23. Go to the Profile tab of your user and Edit

24. In the Title enter the External role name of the new role you created in Abiquo system, i.e. External_role.

25. In the Department field enter the name of the Enterprise you created in Abiquo system, i.e. ExternalEnterprise

26. Save the Profile changes

4. Configure your Abiquo API server

27. On the Abiquo API server, go to /opt/abiquo/config/saml (if this folder does not exist, then create it). Create a keystore.jks with the alias and password specified in the properties, for example: 

keytool -genkeypair -v -keystore keystore.jks -storepass changeit -alias Test -keypass changeit -keyalg RSA -keysize 2048 -validity 10000

28. Upload the idp_metadata.xml file downloaded from the SAML application in step 10. to the /opt/abiquo/config/saml folder.

29. Edit your /opt/abiquo/config/abiquo.properties and add the following configuration for Okta SAML, remember to change the respective values:

30. Edit /var/www/html/ui/config/client-config-custom.json and add the following configuration to allow SAML login:

31. Restart your abiquo-tomcat service