Okta

Configure Okta as the Single Sign-On provider for your Kargo instance, using Dex with the SAML connector.

Enable OIDC on the instance first — see Configuring SSO.

Working SAML Configuration with Okta

Below is an example Dex configuration for Okta:

connectors:
  - type: saml
    id: okta
    name: OKTA
    config:
      ssoURL: https://yourorganization.oktapreview.com/app/yourorganizationsandbox_appname/sso/saml
      redirectURI: https://<kargo_instance_id>.kargo.akuity.cloud/dex/callback
      usernameAttr: name
      emailAttr: email
      groupsAttr: groups
      caData: <certificate from IdP>

Reference: https://dexidp.io/docs/connectors/saml/

Steps to configure Okta for SSO with SAML

1. In your Okta Admin Dashboard, Go to Applications -> Applications -> Create App Integration

   

2. Select SAML 2.0 and click Next

   

3. Give your application a name and click Next

   

4. In Configure SAML section, enter the following details:

   • Single sign on URL: https://<kargo_instance_id>.kargo.akuity.cloud/dex/callback

   • Audience URI (SP Entity ID): https://<kargo_instance_id>.kargo.akuity.cloud/dex/callback

   • In the Attributes Statements section add :

     Name	Name format	Value
     email	Unspecified	user.email
     name	Unspecified	user.fullName

   • In the Group Attribute Statements section add the following, (you can modify the group regex according to your needs) :

     Name	Name format	Filter
     groups	Unspecified	Matches regex : .*

   • Click Next and Finish

5. Go to the Application details page, select Sign On tab and then find and click the View SAML setup instructions button on the right side.

   

6. Copy the Identity Provider Single Sign-On URL and use it for ssoURL: in the Dex config.

   

7. Download the Certificate and base64 encode it, then apply it to your Dex config.