Setting up SSO with Okta

Companies and universities can use Okta to set up Single Sign-On (SSO) with Tower’s Customer Portal.

Requirements for setting up SSO:

• Subscription must have either Enterprise or University plan.
• The user must be owner of the organization.

Retrieve SSO configuration values from Tower Customer Portal

1. Open Tower Customer Portal and sign in.
2. In navigation side bar click on “Account”.
3. In “Organizations” section click “Edit” for the organization you want to set up SSO.
4. A form with SSO configuration options will appear. Keep this page open because you will need to use “SSO callback URL” and “Issuer” values when configuring Okta.

Create a new app in Okta for authentication with Tower

1. In a new browser tab sign into Okta.
2. Open navigation side bar (click “☰” symbol) and navigate to “Applications”.
3. Click “Create App Integration” button.
4. Select “SAML 2.0” option and click “Next”.
5. In “App Name” field type “Tower” and click “Next”.
6. In “SAML Settings section”:
   1. Find “Single sign on URL” field in Okta and paste “SSO callback URL” field’s value from Tower Customer Portal.
   2. Find “Audience URI (SP Entity ID)” field in Okta and paste “Issuer” field’s value from Tower Customer Portal.
   3. Leave other settings as is or configure them for your own needs.
7. Click “Next” button.
8. If asked “Are you a customer or partner?” select “I’m an Okta customer adding an internal app” and click “Finish”.
9. In the newly created Tower app’s page in Okta select “Sign On” tab and under “SAML Signing Certificates” section on the right side click “View SAML setup instructions” button.
10. A new tab with instructions will open. Keep the new tab open because the “Identity Provider Single Sign-On URL” and “X.509 Certificate” will be required to finish SSO configuration in Tower Customer Portal.

Add Okta specific configuration to Tower Customer Portal

1. Find the previously open “Edit Organization” form in Tower Customer Portal.
2. Find “Target URL” field in Tower Customer Portal and paste “Identity Provider Single Sign-On URL” value from Okta’s SAML Setup Instructions page.
3. Find “Identity provider’s certificate” field in Tower Customer Portal and paste “X.509 Certificate” value from Okta’s SAML Setup Instructions page.
4. Finally, click the “Update Organization” button.

Add users to the Tower app in Okta

Remember to add all your organization’s users that need access to Tower to the newly created Tower app in Okta. Now these users will be able to authenticate in Tower Customer Portal using SSO and activate Tower app using the “Activate Tower App” button in Tower Customer Portal’s Dashboard or by using the License Key that is found in “My Licenses” page in Tower Customer Portal.

Keep in mind that in order for a new user to successfully authenticate using SSO, the matching subscription needs to have at least one available seat. If all seats are used, then the user will not be able to authenticate using SSO and activate the Tower app.