Skip to main content

Configuring GravityZone Control Center single sign-on with Okta

GravityZone Cloud supports single sign-on (SSO) with various Identity Providers (IdP) that use SAML 2.0 as authentication standard.

This topic describes how to configure GravityZone Cloud single sign-on with Okta. For generic information on configuring other Identity Providers, refer to Configuring single sign-on using a 3rd party identity provider.

Prerequisites and requirements

  • You have an Okta account with administrator privileges to create, activate and assign applications to users.

  • You have a GravityZone Cloud administrator account to manage users, your company and other companies.

  • GravityZone users have Okta accounts with the same email addresses.

Important

  • As GravityZone administrator, you can configure single sign-on for users from your company and from companies under your management. You cannot enable SSO for your own GravityZone account due to security reasons.

  • SSO and two-factor authentication (2FA) cannot be used simultaneously. When you enable SSO for a user, 2FA is disabled for that user.

  • Email addresses are case sensitive with GravityZone SSO. Therefore, username[at]company.domain is different from UserName[at]company.domain and USERNAME[at]company.domain. If the email address from GravityZone does not match the email address from the identity provider, the user will receive a login error message when trying to connect to Control Center.

  • GravityZone only supports service provider initiated login. IdP-initiated login is not supported.

Extract the GravityZone SP signing certificate

Extract the GravityZone SAML metadata using the following steps:

  1. Log in to Bitdefender GravityZone as an administrator.

  2. Click your user name in the upper right side of the screen and select My Company.

  3. Go to the Authentication tab.

  4. Under the Direct GravityZone single sign on section, copy the GravityZone SAML medatada URL.

  5. Open the metadata URL in a separate tab of your browser and save the page as a metadata.xml file.

  6. Open the metadata.xml file you saved in the previous step.

  7. Copy the <ds:X509Certificate>...</ds:X509Certificate> value as shown below and paste it into a text editor.

    gz_okta_create_SAML_xml2_c_108742_en.png

  8. Add the following lines at the beginning and end of the file:

    -----BEGIN CERTIFICATE-----

    -----END CERTIFICATE-----
    gz_okta_create_SAML_xml3_c_108742_en.png

  9. Save the file you created as certificate.cer.

Configure Okta

This is how you configure an Okta application for GravityZone Control Center SSO:

Create the SAML application

  1. Log in to the Okta Admin Console.

  2. In the left-side menu, go to Applications > Applications.

    sso_gz_services_okta_01_admin_console_cp_1573359_en.png

  3. Click Create App Integration.

    sso_gz_services_okta_02_create_app_cp_1573359_en.png

  4. In the Create a new app integration window, select SAML 2.0 as sign-in method, and click Next.

    sso_gz_services_okta_03_saml_20_cp_1573359_en.png

  5. On the Create SAML Integration page, apply the following configuration:

    1. Under the General Settings tab:

      1. Enter an app name (for example, Bitdefender GravityZone).

      2. (Optional) Upload a logo image and set your app’s visibility.

      3. Click Next.

      gz_okta_01_app_name_cp_108742_en.png

    2. Under Configure SAML, follow the steps below:

      1. Under Single sign on URL, enter https://gravityzone.bitdefender.com/sp/login and select the checkbox for Use this for Recipient URL and Destination URL.

      2. Under Audience URL (SP Entity ID), enter https://gravityzone.bitdefender.com/sp

      3. For Name ID format, select EmailAddress.

      4. For Application username, select Email.

        gz_okta_02_app_saml_settings_cp_108742_en.png

      5. Click the Show Advanced Settings link.

      6. Apply the following configuration:

        1. For Response, select Signed.

        2. For Assertion Signature, select Signed.

        3. For Signature Algorithm, select RSA-SHA256.

        4. For Digest Algorithm, select SHA256.

        5. For Assertion Encryption, select Unencrypted.

        6. Under Signature Certificate, upload the GravityZone Control Center certificate created previously (certificate.cer).

        7. For Enable Single Logout, select the checkbox for Allow application to initiate Single Logout to display new options.

        8. Under Single Logout URL, enter https://gravityzone.bitdefender.com/sp/logout

        9. Under SP Issuer, enter https://gravityzone.bitdefender.com/sp

        10. For Authentication context class, select PasswordProtectedTransport.

        11. For Honor Force Authentication, select Yes.

        12. For SAML Issuer ID, leave the default value: http://www.okta.com/${org.externalKey}.

          Leave the rest of the fields blank.

        gz_okta_03_app_advanced_settings_cp_108742_en.png

      7. Click Next.

    3. Under Feedback, select I'm an Okta customer adding an internal app and click Finish.

      gz_okta_04_app_feedback_cp_108742_en.png

After finishing the configuration, Okta will redirect you to a page containing details about the application you have created.

gz_okta_05_app_sign_on_cp_108742_en.png

Assign users to the application

  1. In the Okta Admin Console, go to the application you just created.

  2. Go to the Assignments tab.

    gz_okta_06_app_assignments_cp_108742_en.png

  3. Click Assign and select Assign to People or Assign to Groups.

  4. Select the relevant users or groups and click Assign for each, then click Done.

    gz_okta_07_app_assigned_cp_108742_en.png

Get the Okta metadata URL

  1. In the Okta Admin Console, go to the application you created.

  2. Go to the Sign On tab.

  3. Under the Settings > SAML 2.0 section, find the metadata URL.

    This is the identity provider metadata URL you will need for GravityZone.

  4. Click the Copy button to copy the URL to the clipboard.

    You will paste this URL in the GravityZone console when enabling SSO for the company.

    gz_okta_08_app_metadata_details_cp_108742_en.png

  5. Go to the Applications page in Okta to verify the status of your application. The application must be Active.

Enable SSO in GravityZone

After configuring single sign-on in Okta, go to GravityZone Control Center to enable SSO for companies and users. Only users under a company with SSO enabled have the option to log in with an Identity Provider.

Enable SSO for your company

This is how you enable SSO for GravityZone Control Center for your company:

  1. In the upper-right corner of Control Center, click the control_center_user_menu_icon.png user icon and then select My Company.

  2. In the Authentication tab, under GravityZone Control Center single sign-on, enter the identity provider metadata URL in the corresponding field. The other field, reserved for the GravityZone metadata URL, is non-editable.

  3. Click Save.

    gz_authentication_sso_console_cp_1573147_en.png

Enable SSO for managed companies

This is how you enable single sign-on for a company under your management:

  1. Log in to GravityZone Control Center.

  2. Go to the Companies page from the left side menu.

  3. In the table, click the company’s name.

  4. Under GravityZone Control Center single sign-on, enter the identity provider metadata URL in the corresponding field. The other field, reserved for the GravityZone metadata URL, is non-editable.

  5. Click Save.

    gz_authentication_sso_console_cp_1573147_en.png

Change the authentication method for users

After enabling SSO for a company, GravityZone user accounts under that company become available for changing their authentication method.

You can change the authentication method for users one by one, as follows:

  1. Log in to GravityZone Control Center.

  2. Go to the Accounts page from the left side menu.

  3. In the table, click the user’s name.

  4. Under Login Security, go to Authentication method and select Login using your Identity Provider.

  5. Click Save.

    You can enable SSO for as many GravityZone users as you want, but not for your own administrator account.

    Note

    You cannot enable SSO for your own administrator account.

Tested identity providers

The following identity providers have been officially tested with GravityZone SSO:

  1. Log out from GravityZone.

  2. Log out from Okta.

  3. Go to https://gravityzone.bitdefender.com/.

  4. Enter a valid email address created for testing (other than the one of your GravityZone administrator account).

  5. Click Next.

    You should be redirected to the identity provider's authentication page.

  6. Authenticate with your identity provider.

    You will be redirected back to GravityZone and, in a few moments, you should automatically log in to Control Center.

Disable GravityZone Control Center SSO

To disable single sign-on for GravityZone Control Center:

  1. Delete the Identity Provider metadata URL from the configuration page of that company.

  2. Click Save and confirm the action.

Users can obtain new passwords by clicking the Reset my password option on the Control Center login page and following the instructions.

To re-enable GravityZone SSO for a company, enter again the identity provider in the configuration page and click Save.

After re-enabling SSO, users under that company will continue to log in to Control Center with GravityZone credentials. You have to manually configure each account, one by one, to log in with the identity provider again.

In this section: