Okta SSO/SAML and Automatic License Provisioning

Okta SSO/SAML and Automatic License Provisioning

Prerequisite: Verify Domain in the Foxit Admin Console

1. Open Foxit Admin Console
2. Navigate to Settings > Directory Setting > Verify Domain / Domain Settings
3. You can verify domains in the following two methods:
• DNS Method – Copy a TXT record to your domain name system. (Recommended)
• Type -> TXT
• Host/Name -> @ or leave blank
• TXT Value -> (Copy>Paste from Foxit Admin Console under
• TTL -> 1 Hour
• HTTPS Method – Upload an HTML file to the root folder of your domain’s website.
• After uploading the HTML file or adding the TXT record, click Verify Domain.
• In the pop-up dialog box, select TXT Record or HTTPS correspondingly, enter the domain you want to verify in the Domain field, and click Verify domain.
• Then the domain will be added to the Verified Domains List, and you can view the verification status. The status of a domain may show Unverified. Verifying domains using DNS may take up to 72 hours for your domain to verify and DNS changes to take effect. Then you can click Verify in the Actions column to verify again.

To remove a domain from the list, click Remove in the Actions column. When a verified domain is removed, the users with that domain are no longer managed and won't appear on your managed account page

Okta SSO/SAML Configuration

You can setup SSO (SAML 2.0) between our Admin Console and Okta following the steps below.

This article contains information and instructions related to a third-party application (Okta). These instructions may vary on your environment and need to be confirmed with your Okta vendor, if necessary.

If you have specific needs or specific settings you need to apply, you may need to check those with your IdP admins.

Supported features

The Okta/[Foxit Admin Console] SAML integration currently supports the following features:

• Service Provider (SP)-Initiated Authentication (SSO) Flow - This authentication flow occurs when the user attempts to log in to the application from Foxit.
• Identity Provider (IDP)-Initiated Authentication (SSO) Flow - This authentication flow occurs when the user attempts to log in to Foxit from Okta.
• JIT (Just-In-Time) Provisioning

Configuration steps

1. Open Okta Admin panel or register an Okta account

Open your Okta Admin panel. (www.okta.com)

2. Create an application

On your Okta Admin panel, go to Applications > Applications > Browse App Catalog

3. Enter "Foxit Admin Console" in the Search catalog of integrations field and select the app "Foxit Admin Console".

4. Click Add Integration.

 

5. Give the application a name (in this example, "Foxit Admin Console"). Click Done.

6. Fill in "Default Relay State" (in this example, "https://adminconsole.foxit.com")

7. Collect the SAML Information

Retrieve the following values from the Admin Console, under User ID Management > Directory Setting:

• SP Assertion Consumer Service URL: The location where the SAML assertion is sent with an HTTP POST. This is referred to as the SP Assertion Consumer Service URL in Foxit Admin Console.

SP Entity ID: The application-defined unique identifier that is the intended audience of the SAML assertion. This is the SP Entity ID in Foxit Admin Console.

8. Fill in SP Assertion Consumer Service URL and SP Entity ID, then click Save.

• Fill in the SP Entity ID of the Admin Console into the SP Entity ID field of Okta
• Fill in the SP Assertion Consumer Service URL of the Admin Console into the into SP Assertion Consumer Service URL field of Okta

9. Supported Attributes

* The following SAML attributes are supported:

Name	Value
email	user.email
firstname	user.firstName
lastname	user.lastName

 

10. SP-initiated SSO

Go to Foxit Admin Console Website: https://adminconsole.foxit.com/, and set the Okta settings in the Foxit Admin Console

Note the following information:

SignOn URL

Issuer

Signing Certificate

(Note: The values below are for illustration only. Note the actual values in your instance.)

 

Copy these three values and paste them into the Admin Console (Setting> Directory Settings):

• Fill in the value of "SignOn URL" from Okta into "Identity provider SSO URL" in the Foxit Admin Console
• Fill in the value of "Issuer" from Okta into "Identity provider Entity ID" in the Foxit Admin Console
• Fill in the value of "Signing Certificate" of Okta into "Public x509 certificate" in the Foxit Admin Console

Click Save Configuration at the end of the page.

Okta Automatic License Provisioning

1. Features

The following provisioning features are supported by Foxit Admin Console:

• Push New Users. New users created through OKTA will also be pushed to Foxit Admin Console.
• Push Profile Updates. Updates made to the user's profile through OKTA will be pushed to Foxit Admin Console.
• Push User Deactivation. Deactivating the user or disabling the user's access to the application through OKTA will be removed the user's licenses in Foxit Admin Console.
• Push Groups. Groups and their members in Okta can be pushed to Foxit Admin Console.
• Reactivate Users. User's authorization reassignment.

3. Configuration Steps

3.1 Enable Provision in Foxit Admin Console

Login to Foxit Admin Console. Navigate to Settings > Directory Setting > Directories.

Select the Okta directory and click Enable Provision to support provisioning with Okta.

3.1.2 Click Provision Settings in the More settings of the Okta directory.

3.1.3 Copy and save the Tenant URL and the Secret token .

These values will be entered in the Tenant URL and Secret Token fields in the Provisioning tab in the Okta.

3.2 Create an app on the Okta admin page

Sign into the OKTA admin page and go to Applications > Applications .

3.2.2 Click Browse App Catalog.

3.2.3 Enter "Foxit Admin Console" in the Search catalog of integrations field and select the app " Foxit Admin Console ".

 

3.2.4 Click Add Integration.

 

3.2.5 Enter your app name and click Next.

3.2.6 Complete the Sign-On Options page. Under the Credentials Details section, select Email for the Application username format. Click Done .

3.3 Configure automatic user provisioning

This section guides you through the steps to configure the Okta provisioning service to create, update, and disable users and/or groups in App based on user/group assignments in Okta.

3.3.1 Go to the Provisioning settings tab and click Configure API Integration.

3.3.2 Select Enable API integration .

3.3.3 Complete the authentication fields.

Input the Tenant URL you got in Foxit Admin Console into Base URL . And Input the Secret Token you got in Foxit Admin Console into API Token .

3.3.4 Click Test API Credentials to test your API credentials.

If you receive an error, verify and retry your credentials. Click Save .

 

3.3.5 From the Settings column on the left side of the screen, select To App , then click Edit.

3.3.6 Select the provisioning options: Create Users , Update User Attributes , Deactivate Users and click Save .

3.4 Create groups on the Okta admin page

In the OKTA Console, go to Directory > Groups . Click Add Group .

Note: The administrator needs to create different groups in OKTA according to the products that need to assign licenses.

A product corresponds to a group:

• Group for Foxit PDF Editor
• Group for Foxit PDF Editor+

 

3.4 .2 Complete the fields in the Add group dialog. Click Save .

• 

3.4 .3 Add the people to the group who should have access to the app.

• 

3.5 Assign group and activate user provisioning

3.5.1 Switch to the Assignments tab, click Assign, and select Assign to Groups.

3.5.2 Select groups to assign, then click Done.

3.5.3 All of these fields are optional and can be left blank. When you are done with this step, click Save and Go Back.

3.5.4 Click Done.

 

3.5.5 Switch to the Push Groups tab, click Push Groups , and select Find Groups By name.

3.5.6 Enter Group for Foxit to search for groups, Select a group to add.

3.5.7 Click Save.

3.5.8 The group is added to the push groups list.

3.6 View results in Foxit Admin Console

Go to Settings > Directory Setting > Directories , Click the + on the OKTA directory to see more information.

3.6.2 Check the Last synced time .

3.6.3 Foxit Admin Console will automatically assign product licenses to group users based on the group names.

3.6.4 Automated log has been added to Foxit Admin Console.

In Contents logs, you can view the log after the license is automatically assigned

4. Troubleshooting and FAQ

If you encounter problems, you can submit a ticket request to Foxit Support team for assistance .

Q1. Are groups created in Okta Enterprise Apps automatically synced to the Admin Console? Will the Admin Console show the group structure?

Answer: The Admin Console will sync the users and display them in the User ID Management->User->Directory users list of the Admin Console.

Q2. Are there rules for the names of groups created in Okta Enterprise Apps?

Answer: The administrator needs to create different groups in Okta according to the products that need to assign licenses. A product corresponds to a group.

The names of these groups need to be fixed and we will give fixed names . The group names are as follows.

• Group for Foxit PDF Editor
• Group for Foxit PDF Editor+

Q3. Can a user be added to multiple directories/groups?

Answer: Yes, a user can be added to different directories/groups .

Q4. What are the rules for the Admin Console to automatically assign licenses based on Okta groups?

Answer: The Admin Console will automatically assign product licenses to group users based on the group names.

When the number of users in the Okta group increases or decreases, the Admin Console will automatically assign or revoke the user's product license.

Q5. Will the group names be case-sensitive?

Answer: Yes, group names are case-sensitive.

Q6. Okta Sync will pull all users from Okta into Admin Console. Will this function only sync the users in the groups or will it continue to sync all users?

Answer: Yes, Only the users/groups of the configured enterprise application will be synchronized, and not all Okta users will be synchronized to the Admin Console.

Q7. When an administrator deletes a user in a group, will the corresponding product license be deleted?

Answer: Yes, if a user of a group is deleted, the user's product license will be revoked.

Q8: If an administrator deletes an entire group, will the entire group's product licenses be removed?

Answer: When deleting the entire group, Admin Console will retain the user's product license and will not delete the product license of the group.

5. Attributes table

Attribute	Format	Field Validation
Locality	String	No restrictions.
Region	String	No restrictions.
Country	String	No restrictions.
Locale Name	String	No restrictions.
Time zone	String	No restrictions.
User type	String	No restrictions.
Employee number	String	No restrictions.
Organization	String	No restrictions.
Department	String	No restrictions.
Manager value	String	No restrictions.
Manager display	String	No restrictions.