Signing in with Okta

This document details configuring Okta SAML for authentication with Dropzone. This is more advanced than using federated buttons such as "Log in with Google" and "Log in with Microsoft" but offers more customization, especially useful for customers with more than one Dropzone environment.

Enabling SAML with Okta involves the following steps:

• Adding Dropzone Role Attribute to User Profile

• Assigning Dropzone Role Attributes to users

• Creating the SAML application in Okta

• Assigning Users to the Dropzone Application

• Providing your SAML IDP details to your Dropzone support representative

• Updating your SAML application with details from your Dropzone support representative

There are multiple ways you can configure Okta successfully with Dropzone AI; we show the simplest version here. However you are welcome to use whatever works best. Perhaps you wish to set the user.dropzone_role via the Application profile, or via Okta Expression Language with custom logic. See Advanced Okta for possibilities.

As long as the values come down where we expect them, in the correct form, the "how" is up to you.

Create the Dropzone Role on User Profile

Dropzone needs to know which role a user should receive when logging into your tenant. There are multiple ways you can configure this, but the most common is to add a field to the user profile or to the Okta application profile.

To create the Dropzone User Profile Role, do the following:

• In the left sidebar of your Okta admin console, navigate to Directory > Profile Editor

Click Profile Editor

• Select the "User (default)" profile

• Under "Attributes," click "Add Attribute"

• Next to Data type, select "string"

• Name the role something memorable, such as "dropzone_role"

• Assign the display and variable names as something memorable, such as "dropzone_role"

• In the description section, input a memorable description, such as "Dropzone AI Access Level"

You may choose a different "Variable Name", but later in this document when you specify SAML attributes you'll need to adjust from user.dropzone_role to the name you used here.

If you store the role somewhere other than the Okta profile then you will need to adjust the SAML attribute value user.dropzone_role to match.

Fill out the attribute details (pt 1)

• Check the box labeled "Define enumerated list of values"

• In the "Attribute Members" section, create the following new values:

Display Name	Value
admin	admin
member	member
restricted-read-only	restricted-read-only

Be sure the "Values" of the attributes match exactly admin, member, and restricted-read-only. The "Display Name" may be something more descriptive if you wish.

Fill out the attribute details (pt 2)

• Leave the "Restriction", "Attribute length", "Attribute required", and "Default value" sections unchecked/blank

• In the User permission section, select "Read Only"

• Click Save

Fill out the attribute details (pt 3)

Assign Dropzone Role Attributes to Users

Next, you must assign the dropzone_role profile value to the users you want to have access to the Dropzone AI platform.

To assign roles to users, do the following:

• In the left sidebar, navigate to to Directory > People

• Select a user you want to have access to Dropzone AI

Select a user

• Navigate to "Profile"

• Click Edit

Edit the user's User Profile

• Locate the Dropzone AI Access Level (or dropzone_role) section and assign the access level for this user

Set the User's `dropzone_role` Value

• Click Save

Repeat for all users who should have Dropzone access

Create the Okta Application

• In the left sidebar, navigate to Applications > Applications

• Click "Create App Integration"

• Select SAML 2.0, then click "Next"

• In the "General Settings" section, name the application something memorable, such as "Dropzone AI"

• If you wish, you may assign the application a logo using one of the following Dropzone icons:

  • transparent

  • white background

  • black background

• Click "Do not display application icon to users"

• Click "Next"

Be sure you do not enable an Okta tile (application icon) for this Application. Dropzone AI does not support IDP-initiated login flows, so the tile will not function properly.

However you can make an Okta "Bookmark Application" that will enable single-click logins to your Dropzone tenant - see Direct Login Links for details.

General Application Settings

• Next to "Single sign-on URL", if you have received a "Dropzone SAML ACS Url" from Dropzone, input it there

Likely this value is is https://login.dropzone.ai/samlv2/acs

• In the Audience URI section, if you have received a "Dropzone SAML Entity ID" from Dropzone, paste it here

• If not, input a placeholder of https://login.dropzone.ai/samlv2/sp/00000000-0000-0000-0000-000000000000

• Next to "Name ID Format", select "Email Address"

• Select your desired Application username

Application SAML Settings

• Click "Next"

• Click "This is an internal app we have created"

• Click "Finish"

• Navigate to the the "Sign On" section of the application

• In the "Attribute statements" section, click "Add expression"

Add more attributes to the application

Add the following attributes individually:

Name	Value
First Name	user.profile.firstName
Last Name	user.profile.lastName
Full Name	user.profile.full_name
Dropzone Role	user.profile.dropzone_role

Example - Add the Dropzone Role

If you chose a different "Variable Name" on the user profile, or are using a different field entirely, update user.profile.dropzone_role to match.

Assign Users to the Dropzone Application

Once you are done configuring the application, you must assign users to it.

To assign users or groups to the application, do the following:

• Navigate to the application's "Assignments" section

• Click "Assign"

• Locate the user/group you want to have access to Dropzone, then click "Assign"

• Click "Assign and continue"

• Assign the user/group the entitlements you wish for them to have, then click "Assign entitlements"

Repeat until you've added all the people/groups who should have access

Gather Application Data for Dropzone

Dropzone needs two pieces of information from your Okta environment to enable the SAML trust.

• Navigate to the application's "Sign On" section

• In the right "About" section, click "View SAML setup instructions"

The Sign On About section

Find the following two pieces of information:

• Identity provider Single Sign-On URL

  • This is a url, typically on an .okta.com domain

• X.509 Certificate

  • This is a multi-line string, starting with -----BEGIN CERTIFICATE----- and ending with -----END CERTIFICATE-----

Copy IDP details

Provide these to your Dropzone support representative. Typically this is done via the Dropzone SAML Request form.

Update Your SAML Application

Dropzone will enable SAML and provide you two values to add to the "SAML Settings" in the "General" tab of your SAML app:

• ACS URL - paste this into "Single Sign-On URL" field

• Entity ID - paste this into the "Audience URI (SP Entity ID)" field

Update these values in your Okta Application and save.

Advanced Okta

Okta has powerful configuration capabilities, including Okta Expression Language which can be used to simplify your Dropzone role provisioning, as an alternative to manually setting roles on a user's profile directly.

This section is here as a reference, not a requirement. Use whatever method you're most comfortable with that balances your administration duties and meets your security standards.

Advanced Okta - Drozone Role via Group Membership

Some customers use Okta Groups coupled with Okta Expression language to populate the dropzone_role attribute automatically. As an example, say you had the following groups:

• access-dropzone-admin

• access-member

• access-read-only

You could use the following

user.isMemberOfGroupName("access-dropzone-admin") ? "admin" :
user.isMemberOfGroupName("access-dropzone-member") ? "member" :
user.isMemberOfGroupName("access-dropzone-read-only") ? "restricted-read-only" :
null

The values (e.g. admin, member, restricted-read-only on the right side above) must match exactly the values we expect, however the groups can be anything that matches your internal naming standands.

Okta Expression Language to populate the dropzone_role attribute

Getting Help

If you have any errors or questions, engage your Dropzone AI support representative.