Okta: single sign-on

Before you start

• In MuchSkills: the Owner or Admin role. Only these roles can open the Security & SAML screen.
• In Okta: an administrator who can create app integrations and assign them to people and groups.
• Your email domains. List every domain your people log in with, for example example.com and example.de. Support adds them for you in step 1.
• Matching email addresses. MuchSkills recognises people by email. The email in Okta should be the address each person uses for MuchSkills.
• A few test users. Assign yourself and two or three colleagues first. Enforce single sign-on only after they can log in.

Steps

In MuchSkills

1. Ask support to add your email domains. Email support@muchskills.com or use the chat in MuchSkills. List every domain your people use. When the domains are added, they appear under Email domains on Team/Org › Settings › Security & SAML, which says No domain added until then.
2. Copy your SSO URL. On the same screen, copy the SSO URL. It starts with https://app.muchskills.com/auth/saml/ followed by your organisation's ID. Keep this tab open.

Team/Org › Settings › Security & SAML: 1 email domains, 2 SSO URL, 3 IDP Metadata URL, 4 Enable SAML.

In Okta

3. Start a new app integration. In the Okta Admin Console, go to Applications and Resources › Applications (Applications › Applications in Classic Engine orgs) and click Create App Integration. If Okta asks, choose Classic experience. Select SAML 2.0 as the Sign-in method and click Next. Okta's guide to SAML app integrations
4. Name it. Under General Settings, enter MuchSkills as the App name. A logo is optional. Click Next.
5. Enter the MuchSkills values. Under Configure SAML:
   • Single sign-on URL: your SSO URL. Keep Use this for Recipient URL and Destination URL ticked.
   • Audience URI (SP Entity ID): the same SSO URL.
   • Default RelayState: leave empty.
   • Name ID format: EmailAddress.
   • Application username: Email.
   • Click Next. Okta's SAML field reference
6. Finish the wizard. Select I'm an Okta customer adding an internal app and This is an internal app that we have created, then click Finish.
7. Add the name attributes. On the app's Sign On tab, click Edit, go to Attribute statements and click Add expression. Add two expressions: firstName with the value user.profile.firstName, and lastName with the value user.profile.lastName. Click Save.
8. Copy the metadata URL. On the app's Sign On tab, find Metadata URL and click Copy. Okta's guide to finding the metadata URL
9. Assign your test users. Open the Assignments tab, click Assign and choose Assign to People or Assign to Groups. Click Assign next to each test user, then Save and Go Back and Done.

Back in MuchSkills

10. Paste the metadata URL. On Security & SAML, paste the URL into IDP Metadata URL. The field opens once your domain is added. Changes save as you make them.
11. Turn on single sign-on. Switch on Enable SAML. People with an email on your domains can now log in with Okta. Until you enforce it, they can still use a password.
12. Test it. Open a private browser window and go to app.muchskills.com/login. Enter the email of an assigned test user and click Continue. MuchSkills recognises the domain and shows Continue with SAML. Click it, sign in with Okta, and you land in MuchSkills.
13. Enforce it, if you want to. When your test users get in, assign everyone who needs MuchSkills in Okta, then switch on Enforce SAML. People on your domains can then only log in through Okta. Admins can still log in with a password. The guide Enforce single sign-on and two-factor authentication explains what changes for people.

Check it worked

• Your test user reaches MuchSkills through Okta, without a MuchSkills password.
• In Team/Org › Settings › Manage Members, people who log in with single sign-on show a SAML label next to their name.

What you get

• One login. People use their Okta account. There is no separate MuchSkills password to remember or reset.
• Access follows Okta. The people and groups you assign in Okta decide who can log in, under your own Okta sign-on policies.
• Leavers lose access. Once you enforce single sign-on, a person you deactivate in Okta can no longer log in to MuchSkills.

Important to know

Email addresses must match. Okta sends each person's email as the Name ID. If it differs from the email on their MuchSkills account, MuchSkills cannot match them. Fix the address in Okta or in MuchSkills so they are the same.

Single sign-on handles login only. To bring people into MuchSkills and keep their details current, also set up Okta: sync users or Okta: SCIM provisioning. SCIM provisioning in Okta is added to this same app integration.

Domains are set up by MuchSkills. We add your email domains when we configure SAML for you; admins cannot add them in the app. To add or remove a domain later, contact support. Single sign-on only applies to email addresses on the domains listed under Email domains.

Admins keep a password route. With Enforce SAML on, Admins can still log in with a password, so you are not locked out if Okta has a problem. Protect those password logins with two-factor authentication.

Certificate changes are picked up automatically. Okta lists the app's certificates under SAML Signing Certificates on the Sign On tab. MuchSkills reads Okta's metadata URL, so when you switch to a new certificate, MuchSkills uses it with no change on your side. Test a single sign-on login after the switch.

Troubleshooting