Download - OrgWikiÒ Active Directory Configuration Guide · The Active Directory integration involves three main steps: 1. Configure the integration between Okta and OrgWiki - This allows Okta

ActiveDirectoryConfigurationGuide Ó2016Veeva.Allrightsreserved.

OrgWikiÒActiveDirectoryConfigurationGuideIntroductionThisguideprovidesinstructionsforconfiguringOktawithOrgWikitoallowauthenticationandprovisioningtobedrivingbyyourexistingActiveDirectoryinfrastructure.ThisguideisintendedforcustomerswhosignedupforOktathroughOrgWiki.ExistingcustomersofOktashouldrefertotheOktaConfigurationGuideTheActiveDirectoryintegrationinvolvesthreemainsteps:

1. ConfiguretheintegrationbetweenOktaandOrgWiki-ThisallowsOktatohandleauthenticationforOrgWikiandtoprovideautomatedprovisioning.

2. SetupActiveDirectoryintegrationwithOkta–ConfiguretheOktaActiveDirectoryAgentwithyourADinstanceandsetupprovisioningrulestoenableautomatedprovisioningofADusersintoOrgWiki

3. Setuptheattributemappings–ThesearemappingsbetweenuserattributesinADandOktaandbetweenOktaandOrgWikitoensuretheappropriateADattributesareprovisionedtoOrgWiki

ConfigureIntegrationbetweenOktaandOrgWikiSignupforOrgWikiandOktaathttps://www.theorgwiki.com/embedded_okta.Thefieldsontheregistrationformwillbeusedto:

1. SignupforanewOktaaccount(includesthefirstadminuser)2. AddtheOrgWikiapptotheOktaaccount3. AssignthefirstadminusertotheOrgWikiapp4. SignupforanewOrgWikiaccount5. ConfigureOrgWikitouseOktaforsingle-signonviaSAML

AftertheabovestepshavebeencompletedyouwillbepromptedtologinviaOktaandthenredirectedtoOrgWiki.SetupActiveDirectoryintegrationwithOktaTosetupActiveDirectory,pleasefollowtheinstructionsonInstallingandConfiguringtheActiveDirectoryAgent.Oncethisiscompleted,userandemployeedatawillbeperiodicallysyncedfromADintotheOktadirectory.Oktarecommendsyouusegroupstotriggerauto-provisioning–onceADgroupsareimportedintoOktayouwillassociateuserswithOrgWikiviatheappropriategrouptotriggerauto-provisioning.


CustomizeAD-OktaattributemappingAkeystepofAD-drivenprovisioninginvolvessettingupattributemappingsfromADintoOktaandthenfromOktatoOrgWiki.UsetheProfileEditortoreviewtheADtoOktamappingsTosetupmappings,intheOktaAdminDashboardyouneedtogotoDirectory->ProfileEditor.SelectyourActiveDirectoryinstanceandclickonMappingstoreviewthecurrentmappings.(Note–youshouldbelookingatthe[AD]toOktamappings.)Bydefault,theOrgWikiusernameissettotheOktausernamewhichdefaultstotheUPN(fromActiveDirectory)oftheuser.OrgWikirequirestheusernamevaluetobetheemailaddressoftheuser.Pleaseensureappuser.emailismappedtotheloginfield

SetupOktaprovisioningtoOrgWikiThefollowinguserattributescanbeprovisionedfromOktatoOrgWiki:DefaultOktaDirectoryattributes:

Attribute Required/Optional CommentsFirstName Required LastName Required Email Required Title Required ManagerID

(emailaddressorIDofmanager)Optional

-Usedforcreatingtheorgchart.-IfIDisuseditneedstomatchthemanager’sExternalId

StreetAddress Optional Setonprofilesandusedforaddingemployeestolocationgroupsandoffices.City Optional

State OptionalCountry OptionalOfficePhone Optional


MobilePhone Optional Nickname Optional

UserType Optional Ifthevalueis“contractor”theemployeewillbemarkedasacontractorinOrgWiki.

Customattributes:

Attribute Required/Optional CommentsStartDate

(mustbeformattedYYYY-MM-DD) OptionalUsedforschedulingthenewhireannouncementandshowingthetenureofanemployeeontheirprofile.

OrgWikiExternalID Optional UniqueIDforemployeese.g.anemployeeID.

StartDateandOrgWikiExternalIDarecustomattributesthatcanbemappedtoOrgWiki.SeeAppendixAandBformoredetailedonaddingtheseattributes.

• FromtheProvisioningtaboftheOrgWikiapp,checktheEnableprovisioningfeaturesbox(seebelow).


• IntheAPIAuthenticationsection,clickAuthenticatewithOrgWiki(seebelow).o Note:ThisuserwillbeusedtoprovisionusersintoOrgWiki.

• AmessagewillappearwithoptiontoallowOktatoconnecttoyourOrgWikiinstance.ClickAuthorize(seebelow).


• NowyourOrgWikiappisauthenticated,scrolldowntheProvisioningpageandselecttheprovisioningfeaturesyouwanttoenable(seebelow).

• ClickNext.CustomizetheattributemappingfromOktatoOrgWikiToeditthemappingsbetweenOktaandOrgWiki,clicktheEditMappingsbuttonunderAttributeMappings,andselecttheOktatoOrgWikitabtoreviewthedefaultmappings.Note–topopulatethemanager’semailaddressintotheOrgWikiManagerIDfieldyoucanusethefollowingexpression:getManagerAppUser(“active_directory”,”active_directory”).email

FormoreinformationonOkta’sexpressionlanguageseehttp://developer.okta.com/reference/okta_expression_language/


AssigninguserstoOrgWikiYoucannowassignuserstotheOrgWikiapp.Donotassignusersmanuallyifyouhavealargenumberofusers,asthisdoesnotscalewell.Instead,useagroupyou’vesynchronizedfromADorcreateagroupdirectlyinOktaforthepurposeofapplicationassignment.ToassignOrgWikitoaselectedgroup:

• InOkta,fromtheAdminDashboard,selectDirectory>Groups,andthenselectthegroupyouwanttoassignto.

• ClicktheManageAppsbuttontoassignappstothegroup(seebelow).


• SearchfortheOrgWikiappandclickAssign,thenclickDone(seebelow).


AppendixA. AddingStartDateAttribute

OrgWikihasaStartDateattributetotheuserprofile.Beforeaddingtheattribute,makesurethedateisformattedcorrectly(YYYY-MM-DD)forOrgWikiusage.Forexample,“2016-01-15”.FollowthestepsbelowtoaddtheStartDateuserattributetotheuserprofile:• InOkta,fromtheAdmindashboard,selectDirectory>ProfileEditor.• SelecttheAppssectionintheleftnavigationbar,thenfindtheOrgWikiappinthelist.• ClickProfilethenclickAddAttribute.

• Type“StartDate”fortheDisplaynamefield.• Type“startDate”fortheVariablenamefield.• ForDescription,type“Employee’sstartdatewiththecompany”.• SelectStringfortheDatatypefield.• YoumayleaveAttributerequiredunchecked.• LeaveScopeunchecked.• ClickAddAttribute.

B. AddingOrgWikiExternalIDAttribute

ThisOrgWikiExternalIDattributecanbeusedtoassociateauniqueIDwithOrgWikiprofiles.FollowthestepsbelowtoaddtheOrgWikiExternalIDuserattributetotheuserprofile:


• InOkta,fromtheAdmindashboard,selectDirectory>ProfileEditor.• SelecttheAppssectionintheleftnavigationbar,thenfindtheOrgWikiappinthelist.• ClickProfilethenclickAddAttribute.

• Type“OrgWikiExternalID”fortheDisplaynamefield.• Type“orgwikiExternalId”fortheVariablenamefield.• ForDescription,type“Auniqueidentifierforthisemployee–typicallyusedacross

apps”.• SelectStringfortheDatatypefield.• YoumayleaveAttributerequiredunchecked.• LeaveScopeunchecked.• ClickAddAttribute.