×

Want to Search?

Go here

Switch Language

Nederlands English

Contact Us

Get Help Give feedback

I am a Zivver admin

Setting up and managing Zivver

Help Center >  SSO with Okta

SSO with Okta

Introduction

Zivver supports Single Sign-On (SSO) via Okta, so that users can login to Zivver with the login data of their workplace. This manual explains how, as an administrator, you set up SSO. SSO operates on the basis of Security Assertion Markup Language (SAML) v2.0. Okta is the Identity Provider (IdP) and Zivver is the Service Provider (SP). To activate SSO in Zivver, you need the following:

  1. You are a Zivver administrator.

  2. You have access to Management functionality in Okta. example URL: `https://[organization]-admin.okta.com/admin/dashboard`

SSO setup in Okta

The first step is to get Zivver set up as a SAML SP application in Okta.

  1. Log in to Okta.

  2. Go to the Admin dashboard.

  3. Go to Applications.

  4. Click Add Application.

  5. Click Create New App.

  6. Set Platform to Web.

  7. Set Sign on method to SAML 2.0.

  8. Click Create.

  9. Enter Zivver as App name.

  10. If necessary, upload a logo, such as the Zivver logo.

  11. Click Upload Logo.

  12. Click Next.

  13. Disable Use this for Recipient URL and Destination URL.

  14. Fill in the following information:

    Setting Value

    Single sign on URL

    https://app.zivver.com/api/sso/saml/consumer/

    Recipient URL

    https://app.zivver.com/SAML/Zivver

    Destination URL

    https://app.zivver.com/api/sso/saml/consumer/

    Audience URI (SP Entity ID)

    https://app.zivver.com/SAML/Zivver

    Default RelayState

    N/A, leave blank

    Name ID format

    EmailAddress

    Application username

    Email

  15. Click Show Advanced Settings.

  16. Fill in the following details:

    Setting Value

    Response

    Signed

    Assertion Signature

    Signed

    Signature Algorithm

    SHA256

    Digest Algorithm

    SHA256

    Assertion Encryption

    No

    Authentication context class

    PasswordProtectedTransport

    Honor Force Authentication

    Yes

    SAML Issuer ID

    http://www.okta.com/{org.externalKey} (Replace {org.externalKey} with your own organizational external key)

  17. Go to the Attribute Statements (optional) section.

  18. Enter the following information:

    Name Value

    https://zivver.com/SAML/Attributes/ZivverAccountKey

    user.id

    urn:oid:2.5.4.42

    user.displayName

    urn:oid:2.5.4.20

    user.mobilePhone

    urn:oid:2.5.4.3

    user.firstName

  19. Click Next.

  20. Set Are you a customer or partner? to I’m an Okta customer adding an internal app.

  21. If necessary, complete the optional questions.

  22. Click Finish.

  23. Go to the Sign On section of your newly created application.

  24. In the Sign On Methods section, locate the Identity Provider metadata link right above the Credentials Details section.

  25. Right-click the Identity Provider metadata link and select Copy Link Address.
    You will need the Link Address when in the next section. Having trouble? Visit the Okta documentation.

  26. Go to Assignments.

  27. Assign the Zivver application to persons/groups.
    Okta is now correctly set up for Zivver.

Setting SSO in Zivver

The final step is to set up SSO in Zivver. You do this in the WebApp of Zivver:

  1. Go to the Zivver WebApp.

  2. Log in as an administrator.

  3. Click the Organization Settings tune icon at the bottom left.

  4. Click Single sign-on vpn_key .

  5. Select Automatically retrieve metadata from URL (recommended).

  6. Paste the URL you have copied at SSO setup in Okta.

  7. Check the option Use Single sign-on.

  8. Click SAVE.
    Okta SSO in Zivver is now set and ready for use.

Warning
 From the moment when you enable SSO, Zivver starts trying to log in users via SAML. It is therefore wise to keep SSO in Zivver switched off until you have set everything up correctly on the Azure AD side. Users who are already logged in will remain logged in after you enable SSO.

Zivver 2FA exemption (optional)

A Zivver account is protected, by default, with an additional login method (2FA). 2FA is also required when logging in via SSO. It is possible to disable Zivver’s 2FA when users log in via Okta’s SSO.

Unfortunately, Okta can not indicate in the SAML response whether the user has already specified an additional login method. Okta always gives the following SAML response:

urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport

This means that the SAML response does not contain any information that Zivver can derive from whether the user is logged in securely with 2FA. Therefore read the warning below carefully.

Warning
 Zivver will never ask for a 2FA if you exempt this authentication context from 2FA in the SSO settings. This is a safety risk when users log in to Okta without a 2FA in combination with a 2FA exemption in Zivver. That is why it is important that users are required to log in to Okta with 2FA when you release the above authentication context in Zivver.

Follow the steps below to set the 2FA exemption for Okta in Zivver:

  1. Log in to the WebApp.

  2. Click Organization Settings tune in the bottom left of the side panel.

  3. Click Single Sign-On (SSO) vpn_key in the User administration card.

  4. In the SAML 2.0 authentication contexts with Zivver 2FA exemptions field, enter the value urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport.

  5. Click SAVE.
    You have now successfully set a 2FA exemption for Okta. When users now log in via SSO, Zivver will not ask for 2FA.

Log in to the WebApp with SSO

  1. Go to the WebApp.

  2. Enter your e-mail address.

  3. What is your role in Zivver?

    • User: you are immediately redirected to the login screen of your organization.

    • Administrator: you choose between your Zivver password and your workplace login details to log in.

  4. Log in with the workplace login data of your organization. Depending on the existence of a 2FA exemption you will be asked for an extra login method. With a 2FA exemption in place, the last step will be skipped.

  5. Use your extra login method. You are logged into the Zivver WebApp.

Log in to Outlook with SSO

In the Zivver Office Plugin in Outlook you log in with SSO in the following way:

  1. Click the Zivver tab.

  2. Click Manage Accounts account_circle .

  3. Click the link Add an account add_circle .

  4. Select the e-mail address with which you want to log in.

  5. Click Yes, I want to log in now.
    You will be redirected to the login screen of your organization.

  6. Log in with the workplace login details of your organization.
    Depending on the existence of a 2FA exemption you will be asked for an extra login method. With a 2FA exemption you skip the last step.

  7. Use your extra login method.
    You are logged in to Outlook.

Updated on 2023-01-27

Was this article helpful?

thumb_up thumb_down