Configure SAML SSO with Okta, PingOne, and OneLogin

NodeSource Accounts supports SAML 2.0 single sign-on (SSO), so your organization can manage access to NodeSource Accounts and the N|Solid Console through an identity provider (IdP) such as Okta, PingOne (Ping Identity), or OneLogin. This page walks through the setup for each provider and explains how to require SAML for all members.

SAML (Security Assertion Markup Language) is an open standard for exchanging authentication and authorization data between an identity provider and a service provider.

Requirements

To set up SAML SSO, you need:

1. An enterprise subscription in NodeSource Accounts.
2. Administrator privileges in NodeSource Accounts.
3. Administrator privileges in your identity provider.

In NodeSource Accounts, SAML is configured in the SAML item of the left navigation. Choose your provider from the dropdown: OKTA, PingOne(Ping Identity), or OneLogin.

Set up SAML with Okta

1. Sign in to your Okta account as an administrator.

2. Go to Admin Dashboard > Applications > Add Application.

3. Click Create New App and choose SAML 2.0 as the sign-on method.

   

4. Enter the general settings for the application, including the app name and, optionally, an app logo.

   

5. Enter the SAML settings:

   1. Single sign on URL: https://api.nodesource.com/accounts/auth/acs
   2. Audience URL: https://api.nodesource.com/accounts/auth/idp-metadata
   3. Name ID format: unspecified

   

6. Enter the attribute statements shown below. They map attributes between Okta and NodeSource.

   

7. Create a new API token (Security > API > Tokens > Create Token).

   

8. In Settings > Features, enable Event Hooks so SAML webhooks can be used.

   

9. In your SAML app, go to Sign On > Settings and copy the link address of the Identity Provider metadata.

   

10. In the SAML settings in NodeSource Accounts, enter the values from the previous steps:

    1. Identity Provider Metadata URL: the Identity Provider metadata link from Sign On > Settings.
    2. App ID: the ID in your Okta SAML app's admin URL. In a URL such as https://<your-okta-domain>/admin/app/<app-name>/instance/<app-id>/, the App ID is the string after instance/.
    3. API Token: the API token you created in Okta.

    

11. Click Test Connection to test the single sign-on connection.

    

Use N|Solid with Okta-based SAML

After your organization turns on the Okta integration, each user must sign in at accounts.nodesource.com once to accept the NodeSource terms and conditions. After that, users can open the N|Solid Console directly with their SAML SSO credentials. To open NodeSource apps from your Okta portal, see SAML integration with Okta.

Set up SAML with PingOne (Ping Identity)

1. Sign in to your PingOne account as an administrator.

2. Go to Applications.

3. On the My Applications tab, click Add Applications and choose New SAML Application. If New SAML Application is disabled, connect to an identity repository first. See the PingOne documentation.

4. Enter the application details, including Application Name and Application Description.

   

5. Enter the SAML settings:

   1. Assertion Consumer Service (ACS): https://api.nodesource.com/accounts/auth/acs
   2. Entity ID: https://api.nodesource.com/accounts/auth/idp-metadata

   

6. Map the application provider (AP) attributes as shown below. Your orgId is shown as ORG ID on the SAML page in NodeSource Accounts.

   

7. Select the user groups that should have access to this application. Members of these groups can sign in to the application with SSO and see it on their personal dock.

   

8. Review the setup and click Finish.

9. On the SAML page in NodeSource Accounts, enter the values from the previous steps:

   1. Identity Provider Metadata: your identity provider metadata (XML).
   2. SSO URL: the single sign-on (SSO) URL of your SAML app.

   

10. Click Test Connection to test the single sign-on connection.

    

Set up SAML with OneLogin

1. If you don't have a OneLogin account, create one at developers.onelogin.com.

2. Sign in as your organization's administrator and go to Apps > Company Apps, then click Add App.

3. Enter SAML in the search box and select SAML Test Connector (Advanced).

   

   

4. In the Application Details section, apply the configuration shown below.

   

5. Set the Parameters as follows:

   

6. On the SSO tab, click View Details to get your X.509 certificate.

   

7. To get your IdP metadata URL, click MORE ACTIONS, right-click SAML Metadata, and copy the link address.

   

8. Select DEVELOPERS > API Credentials to create API credentials.

   

9. Click New Credential, select Manage All, and save.

   

10. Your API credentials (CLIENT SECRET and CLIENT ID) are created.

    

11. In accounts.nodesource.com, go to the SAML page.

12. Paste the metadata URL from step 7 into Identity Provider Metadata URL.

13. Enter the App ID. In your OneLogin SAML app's URL, such as https://<your-subdomain>.onelogin.com/apps/<app-id>/, the App ID is the number after apps/.

14. Enter the Client ID and Client Secret you generated in step 10 in their fields, as shown below.

    

Require SAML authentication

You can require SAML authentication for your organization, so that only users who can sign in with your organization's Okta, PingOne, or OneLogin credentials have access. Members you invited without SAML (such as third-party contractors) receive an email and lose access to the organization. Use this to restrict access to your NodeSource organization, accounts.nodesource.com, and the N|Solid Console.

To turn it on, open the SAML page in accounts.nodesource.com and turn on the Require Saml Authentication toggle.