Configuring OneTrust with Okta for Single Sign-On (SSO) Authentication

OneTrust Environment Metadata

You can use OneTrust's environment metadata to bypass manual SSO configuration if supported by your IdP.

1. Download metadata from the Single Sign-On screen

   OneTrust's environment metadata can be downloaded directly from the Single Sign-On screen in Global Settings using the Download metadata field on the Configuration tab.

   Note:

   The Download metadata field is only visible when Metadata is selected in the Setup options field.

   
   
   

2. Download metadata from OneTrust Environment Metadata

   You can download a collection of OneTrust's metadata files in the following article: OneTrust Environment Metadata. On the File Details page, click the Download button to download the zip file. You will need to use the specific metadata file that corresponds with your environment, which can be identified based on the URL as highlighted in the image below.

   
   
   

   For example, if the URL used to log in to the OneTrust Platform is app.onetrust.com, then you would use the app OneTrust Metadata file. If you are using a custom domain or custom subdomain, the metadata will remain the same. For example, if your custom subdomain youramazingcompany.my.onetrust.com was created on the uat-de.onetrust.com environment, then you would use the uat-de OneTrust Metadata file.

3. Create SAML metadata with a single signing certificate

   If your identity provider supports only one certificate, open the downloaded metadata file in a text editor and remove the additional <md:KeyDescriptor> block. Verify that the file contains only one <md:KeyDescriptor use="signing"> block, then save the file and upload it to your identity provider.

   To use an upcoming OneTrust certificate, download it from the Certificates tab, copy the certificate value, and replace the value between <ds:X509Certificate> and </ds:X509Certificate> in the metadata file.

   
   
   

OneTrust Signed Certificates

When creating a web application, you can import the OneTrust certificate for your respective application environment into your IdP. Your IdP may use this certificate for encrypting assertions or for verifying SLO requests signed by OneTrust (if the Sign SAML requests setting on the Single sign-on screen is enabled in the OneTrust Platform).

If you would like to complete this process, OneTrust Signed Certificates can be downloaded directly from the Single sign-on screen in Global Settings using the Download current OneTrust certificate field on the Configuration tab or using the Certificates tab. Additionally, upcoming OneTrust Signed Certificates can be downloaded from the Certificates tab, if available.

To create a web application in Okta

1. Log in to your Okta developer account.

2. On the main navigation menu, click Applications > Applications. The Applications screen appears.

   
   
   

3. Click the Add Application button. The Add Application screen appears.

   
   
   

4. Click the Create New App button. The Create a New Application Integration modal appears.

   
   
   

5. On the Create a New Application Integration modal, select Web in the Platform field, and select SAML 2.0 in the Sign on method field.

6. Click the Create button. The Create SAML Integration screen appears. The Create SAML Integration process is divided into three sections: General Settings, Configure SAML, and Feedback.

7. In the General Settings section, enter a name for the application in the App name field. You can also upload an organization logo, as well as establish the app visibility. Once complete, click the Next button. The Configure SAML section appears.

   
   
   

8. In the Configure SAML section, complete the following fields in the General section using the metadata file that you downloaded for your respective OneTrust application environment. For more information, you can find a detailed description of the entries required for each field in the following table.

   
   
   

   Field

   Description

   Single sign on URL

   Select the Use this for Recipient URL and Destination URL check box. Then, within the metadata file that you downloaded for your application environment, locate the AssertionConsumerService attribute. Copy the corresponding URL and paste it into the Single sign on URL field.

   
   
   

   Audience URI (SP Entity ID)

   Within the metadata file, locate the EntityDescriptor attribute. Copy the corresponding entityID URL and paste it into the Audience URI (SP Entity ID) field.

   
   
   

   Default RelayState

   Leave this field blank.

   Name ID format

   Select the EmailAddress option.

   Application username

   Select the Email option.

9. Click the Show Advanced Settings link. Complete the following Advanced Settings fields. For more information, you can find a detailed description of the entries required for each field in the following table.

   
   
   

   Field

   Description

   Response

   Select the Signed option. OneTrust recommends using a Signed Response. If the Response is signed, you must ensure that the signed IdP certificate is uploaded within the OneTrust Platform via the Single sign-on screen in Global Settings.

   Assertion Signature

   Select the Signed option. OneTrust recommends using a Signed Assertion. If the Assertion is signed, you must ensure that the signed IdP certificate is uploaded within the OneTrust Platform via the Single sign-on screen in Global Settings.

   Signature Algorithm

   The option selected by default is RSA-SHA256. OneTrust supports this Signature Algorithm.

   Digest Algorithm

   The option selected by default is SHA256. OneTrust supports this Digest Algorithm.

   Assertion Encryption

   OneTrust supports encrypting assertions. If you would like to encrypt assertions, select the Encrypted option. This is optional.

   Note:

   Once Encrypted is selected in the Assertion Encryption field, the Encryption Algorithm, Key Transport Algorithm, and Encryption Certificate fields will appear.

   Encryption Algorithm

   The option selected by default is AES256-CBC. OneTrust supports this Encryption Algorithm.

   Key Transport Algorithm

   The option selected by default is RSA-OAEP. OneTrust supports this key Transport Algorithm.

   Encryption Certificate

   Click the Browse Files button and upload the OneTrust signed certificate for your application environment. The file must be correctly formatted as a X.509 certificate to successfully upload.

   Note:

   You can find the OneTrust signed certificate for your application environment in the latest version of the OneTrust Signed Certificates.zip file here.

   Enable Single Logout

   Select the Allow application to initiate Single Logout check box.

   Note:

   The OneTrust signed certificate must be uploaded if the Sign SAML requests setting is enabled on the Single sign-on screen in the OneTrust Platform and you plan to use Single Logout.

   Once the Allow application to initiate Single Logout check box is selected, the Single Logout URL, SP Issuer, and Signature Certificate fields will appear.

   Single Logout URL

   Within the metadata file, locate the SingleLogoutService attribute. Copy the corresponding URL and paste it into the Single Logout URL field.

   
   
   

   SP Issuer

   This field is not required.

   Signature Certificate

   The OneTrust signed certificate must be uploaded if the Sign SAML requests setting is enabled on the Single sign-on screen in the OneTrust Platform and you plan to use Single Logout.

   Note:

   OneTrust uses the same certificate as both the encryption and signature certificates.

10. In the Attribute Statements (optional) section, the entries made in the Name fields in Okta should identically match the entries that appear on the Attributes mappings tab of the Single sign-on screen in the OneTrust Platform. This will be completed in Step 3: Map Attributes between Okta and the OneTrust Platform below.

11. Click the Next button. The Feedback section appears. Select an option for the Are you a customer or partner? question and provide optional feedback for Okta, as needed.

12. Click the Finish button.

To access Okta's Setup Instructions

1. Navigate to the Sign On tab for the web application you created in the procedure above.

   
   
   

2. Click the View Setup Instructions button. The How to Configure SAML 2.0 screen appears. You will use the information on this screen to complete the following procedure.

To configure SSO in OneTrust with Okta

1. Click the gear icon
   in the upper right-hand corner to access Global Settings.

2. On the Global Settings menu, click Access management > Single sign-on. The Single sign-on screen appears.

3. Enable Would you like to enable Single Sign-On?.

   
   
   

4. In the Notification Recipient field, select the user(s) and/or user group(s) to be notified when action is required regarding the SSO configuration. User(s) or user group(s) must be selected in this field in order to save changes to your SSO configuration. 

   
   
   

5. In the Service Provider Configuration section, complete the following fields.

   
   
   

   Field

   Description

   Response binding type

   Select the method you want to use to exchange requests and responses.

   Sign SAML requests

   Enable this setting to have OneTrust sign the AuthNRequest and Single Log Out (SLO) Request for additional security. When enabled, the Download current OneTrust certificate field appears within Setup options - Manual. If this setting is enabled, ensure that the OneTrust Signed Certificate is uploaded in your IdP.

   Setup options

   Select the option corresponding to how you will be configuring SSO within your IdP. The following options are available:

   • Manual - Configure SSO manually in your IdP using the provided OneTrust Service Provider Details. If selected, the Service provider name, Lockout URL, and Download current OneTrust certificate fields appear.

     Note:

     The Download current OneTrust certificate field only appears if the Sign SAML requests setting is enabled.

   • Metadata - Configure SSO by downloading OneTrust's environment metadata and uploading it into your IdP. If selected, the Download metadata field appears.

   Setup options - Manual

   Service provider Name

   Lockout URL

   This is the URL that Internal Site admins in the root organization can use to disable SSO to resolve SSO Lockout. 

   Download current OneTrust certificate

   Click the Download button to download the current OneTrust Signed Certificate for your environment. The OneTrust Signed Certificate will need to be uploaded in your IdP.

   Note:

   Current OneTrust Signed Certificates can be downloaded from this field or from the Certificates tab that appears after the initial SSO configuration is saved. 

   This field and the Certificates tab only appear if the Sign SAML requests setting is enabled.

   Setup options - Metadata

   Download metadata

6. In the Identity provider configuration section, complete the following fields. You will enter the Okta Issuer details found within Okta's Setup Instructions for the web application you created above.

   
   
   
   
   

   Field

   Description

   Request Binding Type

   Select the method you want to use to exchange requests and responses.

   Name

   In Okta, copy the contents of the Identity Provider Issuer field. Navigate to the OneTrust Platform and paste the contents into the Name field within the Identity provider configuration section on the Single sign-on screen.

   Note:

   Please ensure that the Identity Provider Issuer ID is not already saved within another account in the same environment or within another organization in the organizational hierarchy.

   SignOn URL

   In Okta, copy the contents of the Identity Provider Single Sign-On URL field. Navigate to the OneTrust application and paste the contents into the SignOn URL field within the Identity provider configuration section on the Single Sign-on screen.

   SignOut URL(Optional)

   In Okta, copy the contents of the Identity Provider Single Logout URL field. Navigate to the OneTrust application and paste the contents into the SignOut URL field within the Identity provider configuration section on the Single sign-on screen.

7. In the Upload certificate section, you will need to upload the certificate for your IdP.

   You can download your IdP certificate from Okta's Setup Instructions. In the X.509 Certificate field, click the Download certificate button. The file will download to your local system.

   
   
   

   Navigate back to the Upload certificate section on the Single sign-on screen in the OneTrust Platform. Click the Upload button to upload the certificate downloaded from Okta. The Subject, Issuer, and Thumbprint fields will populate with the certificate information and cannot be edited.

   
   
   

8. Click the Save button. The Attribute mappings, Assignments, and Domains tab appear.

To assign users in Okta

1. Navigate to the Assignments tab for the web application you created.

   
   
   

2. Click the Assign button, and select Assign to People. The Assign to People modal appears.

   
   
   

3. Click the Assign button next to the name of the user you wish to assign. You can then modify the user name of the user. If no changes are required, click the Save and Go Back button. Repeat this step for each user you want to assign.

   
   
   

4. Click the Done button. The users will then appear on the Assignments tab.