You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: content/blog/okta-sso-integration-for-green-lake-and-aruba-central.md
+19-21Lines changed: 19 additions & 21 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -30,11 +30,11 @@ To configure application metadata in Okta, complete the following steps:
30
30
2. Click **Applications > Create App Integration.** The Create a new app integration window opens.
31
31
3. Select SAML 2.0 and click Next.
32
32
33
-
33
+
34
34
35
35
Provide a name for the Aruba GreenLake SSO service (Okta Application)
36
36
37
-
37
+
38
38
39
39
**Step 2: Configure Single Sign On settings**
40
40
@@ -59,13 +59,13 @@ Provide a name for the Aruba GreenLake SSO service (Okta Application)
59
59
60
60
One of the additional features added as part of the GreenLake CCS is Role Based Access Controls (RBAC) for Aruba Central and all other apps in CCS. A new SAML attribute has been added “hpe_ccs_attribute” which tells GreenLake and Central the exact role/permissions for each user. The following describes how to format the attribute.
61
61
62
-
62
+
63
63
64
-
64
+
65
65
66
-
66
+
67
67
68
-
68
+
69
69
70
70
The **hpe_ccs_attribute** will always start with **version_1#**. First, we’ll configure the attributes for GreenLake CCS, then Central. First enter the PCID for the account, followed by the GreenLake application ID. This will always be **00000000-0000-0000-0000-000000000000**. Then followed by the role name and **ALL_SCOPES**. Next will be the Aruba Central info. Start with the **app cid**, then the role name (IE Aruba Central Administrator) then **ALL_SCOPES**.
71
71
@@ -81,13 +81,11 @@ Example:
81
81
82
82
If you want to add additional GreenLake applications or if you have multiple Aruba Central accounts, you can add them as well. Just follow the same syntax as before. Once you have the attribute defined, enter it into the SAML attribute statement in Okta as shown below.
83
83
84
-
84
+
85
85
86
86
2. Complete the setup.
87
87
88
-
89
-
90
-
88
+
91
89
92
90
Click Next and Select “Internal App” then Finish
93
91
@@ -99,7 +97,7 @@ Click Next and Select “Internal App” then Finish
99
97
100
98
Suggestion: Click **Identity Provider metadata** and save the XML data to a file.
101
99
102
-
100
+
103
101
2. Click Next
104
102
3. Select Internal app and Click Finish
105
103
@@ -109,32 +107,32 @@ Click Next and Select “Internal App” then Finish
109
107
110
108
*Before you can add a new SAML configuration, you must have at least one user account with that domain already enabled in GreenLake. Also, you must be logged into GreenLake with an account from that domain in order to enable SSO for that domain.*
111
109
112
-
110
+
113
111
2. Type in the domain you want to enable SSO on:
114
112
115
-
113
+
116
114
3. Input the metadata from the above step
117
115
118
116
While GreenLake does support manually entering this info, it’s recommended to simply upload the XML metadata that was downloaded in the previous step. Select Metadata File and select the XML. Then click Next.
119
117
120
-
118
+
121
119
4. Enter the SAML attributes to match what was entered in Okta and set the idle timeout value as well.
122
120
123
-
121
+
124
122
5. Then click Next.
125
123
6. Create a recovery user in the event SSO fails, an admin will still be able to access GreenLake.
126
124
127
-
125
+
128
126
129
127
Congratulations SSO will now be enabled for GreenLake as well as the Aruba Central application. Log out and on the GrenLake home page, click Sign in with SSO.
130
128
131
129
**Testing and Troubleshooting:**
132
130
133
131
On the GreenLake Cloud Platform home page, Click Sign in with SSO.
134
132
135
-
133
+
136
134
137
-
135
+
138
136
139
137
Enter the SSO credentials and you will be redirected to Okta to authenticate. Once you successfully authenticate, you will be redirected back to GreenLake. You can then click on the Aruba Central application and given access based on the configured role/permissions.
140
138
@@ -152,12 +150,12 @@ Enter the SSO credentials and you will be redirected to Okta to authenticate. On
0 commit comments