Nile integrates well with directory services using SAML 2.0. This integration can be used for SSO/RBAC to Nile dashboard and also for wired and wireless access. This write up will go over setting up Okta as an Identity Provider in Nile dashboard and SSO for Role Based Access Control (RBAC) to the dashboard.
Okta Setup:
Setting up a new app integration. Make sure to use SAML 2.0.
Give this app a name
Under SAML settings just put dummy information for now. We will come back to this and fill in the right information later.
Last step, I just chose the second option and Finish
Next I grabbed some information from Okta including the certification that will be used in Nile Portal. Open up the application, click on “Sign On”, click on “More Details”
We only need these two things from here
- Sign on URL –> IdP SSO URL (Nile Portal)
- Sign on URL –> Destination URL (Nile Portal)
- Issuer –> IdP Issuer URI (Nile Portal)
- Certificate –> Download, Open, Copy/Paste (Nile Portal)
Nile Setup:
Now we have all the information for the Nile Portal, time to add it in there. From “Settings” –> “Global Settings” and Identity I am going to add a provider. Following the guidelines above enter information as follows. Upload the certification and this part is done.
Remember the dummy information we added early on, it is time to update that information with the correct information. I am going to extract that information for Okta app from the “Metadata” file.
From the “Metadata” file I need the following information. Best thing to do is to open it in a text edit and do a “Ctrl + Find” to find this information.
- Location
- Entity ID
Nile Group Rules:
Before heading back to Okta, I am going to create the group mapping and Group Rules.
Step 1: Add Group Mapping as shown in the picture below.
Step 2: Create two group rules for RBAC to the Nile Portal. These need to match in Okta.
- NileMonitor
- NileAdmin
Back to Okta:
Time to edit Okta app and update some information in there. Enter those values under Single sign-on URL and Audience URI (SP Entity ID).
Scroll down a little on the same page and let’s add some Attribute Statements.
firstName user.firstName
lastName user.lastName
displayName user.displayName
mail user.email
mobile usermobilePhone
Under "Group Attribute"
memberOf --> Filter (Contains Nile)
Step 1: Create the two groups in Okta for RBAC to Nile Portal. These should match what was created in the Nile Portal.
Step 2: Assign the groups to the application.
I have currently two users, one in
- (jsmith) NileMonitor
- (mali)NileAdmin
If I log in as “mali” I will log in as an Admin with full access to making changes.
But if I log in as “jsmith” who is supposed to be for monitoring only, I can view only but not make any changes. Screenshots below show that all areas where changes can be made can not be edited.
This takes care of setting up Okta within the Nile Dashboard as an Idp and setting up SSO for Role Based Authentication. Keep an eye out for more on SSO and Nile integration.